9acd60886967cb13a450e88ec259919a75e3660a2d4d280b93985d664bcf86b1

Analysis

max time kernel
126s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 23:40

Target

9acd60886967cb13a450e88ec259919a75e3660a2d4d280b93985d664bcf86b1.dll
Size

1.5MB
MD5

e81a2c8613057e29d070aa87d5a12a82
SHA1

bd7db8ca88e13b3cdb97acae5781544bb605c1ee
SHA256

9acd60886967cb13a450e88ec259919a75e3660a2d4d280b93985d664bcf86b1
SHA512

366508970e895686d14c8eaebd138d25474f2c1625401166174e063c331f7cd67605b8d211c5b26f7b7a0de850311b71d57936b32030375e7afa876b9d7fd1af
SSDEEP

24576:v6RtC7vXfX8kGhi98lIYVprZ9SdhU5Tijli8M7bCMxzuOld+bmrs8Zp2CMkjymcX:JHX8fh+BYjrqhM8+r+bmzp2fkjymcS

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1904-0-0x0000000010000000-0x00000000104F8000-memory.dmp	vmprotect
behavioral2/memory/1904-1-0x0000000010000000-0x00000000104F8000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1904	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1904	2360	rundll32.exe	81
PID 2360 wrote to memory of 1904	2360	rundll32.exe	81
PID 2360 wrote to memory of 1904	2360	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acd60886967cb13a450e88ec259919a75e3660a2d4d280b93985d664bcf86b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acd60886967cb13a450e88ec259919a75e3660a2d4d280b93985d664bcf86b1.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1904

memory/1904-0-0x0000000010000000-0x00000000104F8000-memory.dmp

Filesize
5.0MB

Download
memory/1904-1-0x0000000010000000-0x00000000104F8000-memory.dmp

Filesize
5.0MB

Download