194c5aaa8547b8329c2ae83a10a1cb9ef3174d9283d272ec84aac257a5bae3b6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 14:20

Target

194c5aaa8547b8329c2ae83a10a1cb9ef3174d9283d272ec84aac257a5bae3b6.dll
Size

15.5MB
MD5

3bdcd75d5ab05891d7dd0d9b07ec226e
SHA1

8335b404fa74ffd811fdee1592a46f9ee7ffb78f
SHA256

194c5aaa8547b8329c2ae83a10a1cb9ef3174d9283d272ec84aac257a5bae3b6
SHA512

650f709e8e5be98928823121c76a5253ba9244cefde847b2ed448a7b4ccff4d7c91c597040ab3e6327ba35cf6f482ad9c201bbfec046835b6be13ed213e89e23
SSDEEP

98304:vyNy0A8YhUdvgOgx024Z6y48PpXLX8STODpG/RRNWfN7:MdYn024X4D

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2500-3-0x00000000720C0000-0x0000000073047000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2500	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28
PID 2772 wrote to memory of 2500	2772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\194c5aaa8547b8329c2ae83a10a1cb9ef3174d9283d272ec84aac257a5bae3b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\194c5aaa8547b8329c2ae83a10a1cb9ef3174d9283d272ec84aac257a5bae3b6.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2500

memory/2500-1-0x0000000073050000-0x0000000073FD7000-memory.dmp

Filesize
15.5MB

Download
memory/2500-2-0x0000000073050000-0x0000000073FD7000-memory.dmp

Filesize
15.5MB

Download
memory/2500-3-0x00000000720C0000-0x0000000073047000-memory.dmp

Filesize
15.5MB

Download
memory/2500-4-0x00000000720C0000-0x0000000073047000-memory.dmp

Filesize
15.5MB

Download