2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 06:33

Target

2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll
Size

1.6MB
MD5

395157ae43f1eb7a36ad3ca8447cba06
SHA1

795cc39a794e90e92b7104ed52ee9efb2647ab2f
SHA256

2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10
SHA512

ebce81cdd0d3746eda47f33b920368d6bde579ee914c65fefcffda2367b7a9c747f7db74442e113f29adc3b1e4542f547d4d4c44e892019609bd7b9eed5bff7d
SSDEEP

49152:5Tz99424Hv+jAXgSGUrieHEMu2GvLELim:Zj424PPgS5WeHEMWTLm

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2636-133-0x0000000074870000-0x0000000074C67000-memory.dmp	vmprotect

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1788	2636	WerFault.exe	81
1152	2636	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2636	1564	rundll32.exe	81
PID 1564 wrote to memory of 2636	1564	rundll32.exe	81
PID 1564 wrote to memory of 2636	1564	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 632
    3⤵
    - Program crash
    PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 812
    3⤵
    - Program crash
    PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2636 -ip 2636
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2636 -ip 2636
1⤵
PID:4668

memory/2636-133-0x0000000074870000-0x0000000074C67000-memory.dmp

Filesize
4.0MB

Download
memory/2636-136-0x0000000000A20000-0x0000000000A34000-memory.dmp

Filesize
80KB

Download
memory/2636-137-0x00000000747E0000-0x0000000074A5E000-memory.dmp

Filesize
2.5MB

Download