47675b08283d0b5558388fbb6c03c97a9cae603ea0841f104b5ba9bb08bed5a3

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 18:06

Target

47675b08283d0b5558388fbb6c03c97a9cae603ea0841f104b5ba9bb08bed5a3.dll
Size

16.0MB
MD5

e8ca8bc9a9bd367ff19eb22a831fd901
SHA1

8938442c83088bb6fd9ff233d0ef8cca8f73ad09
SHA256

47675b08283d0b5558388fbb6c03c97a9cae603ea0841f104b5ba9bb08bed5a3
SHA512

eba6e040f587e1861c65a80264a16ecffccbfc98a0dfd9f8f44c848c005d50ce0a603b58b1cfa587d24ce9277096539cd8dff7c4701d590bcede85dd6d8a5c56
SSDEEP

393216:MByrsRfpDIy5jrQNOF4h7jNFtgaNaCOp2xgt:MByrsjDBc4eh3/ad

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2228-0-0x0000000010000000-0x0000000010FF4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28
PID 2452 wrote to memory of 2228	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47675b08283d0b5558388fbb6c03c97a9cae603ea0841f104b5ba9bb08bed5a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47675b08283d0b5558388fbb6c03c97a9cae603ea0841f104b5ba9bb08bed5a3.dll,#1
  2⤵
  PID:2228

memory/2228-0-0x0000000010000000-0x0000000010FF4000-memory.dmp

Filesize
16.0MB

Download
memory/2228-1-0x0000000010000000-0x0000000010FF4000-memory.dmp

Filesize
16.0MB

Download
memory/2228-2-0x0000000010000000-0x0000000010FF4000-memory.dmp

Filesize
16.0MB

Download
memory/2228-3-0x0000000010000000-0x0000000010FF4000-memory.dmp

Filesize
16.0MB

Download