7add532571c32b228a7835a5487393c1ed648196e9bdbc472358877b6de383d7

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 13:48

Target

7add532571c32b228a7835a5487393c1ed648196e9bdbc472358877b6de383d7.dll
Size

9.1MB
MD5

423fa8324bc14fa46c787abebd1131a1
SHA1

71c0d4ffad1e809cd24e74cdabc689ac067c5a98
SHA256

7add532571c32b228a7835a5487393c1ed648196e9bdbc472358877b6de383d7
SHA512

62478ab1f9a821b69d076bf382e19a7f8a7695d79ac814f7002f05168f5ffb9cd0e94dfb06d1e466b66ea51d039d096704544078e8a2e11789d733f7fd03570e
SSDEEP

196608:n2NEOmJUVOWHnTAsd84iTZnyaws8AKZYscYkBp87hEj:n29VOWHT+tndwVhkHSS

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4672-0-0x0000000074480000-0x0000000074D9B000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	4672	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 4672	1452	rundll32.exe	85
PID 1452 wrote to memory of 4672	1452	rundll32.exe	85
PID 1452 wrote to memory of 4672	1452	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7add532571c32b228a7835a5487393c1ed648196e9bdbc472358877b6de383d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7add532571c32b228a7835a5487393c1ed648196e9bdbc472358877b6de383d7.dll,#1
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 592
    3⤵
    - Program crash
    PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4672 -ip 4672
1⤵
PID:3028

memory/4672-0-0x0000000074480000-0x0000000074D9B000-memory.dmp

Filesize
9.1MB

Download