bdea64858229772c88c92bfff9d8585554d24164e09b597cc342cd279612da0c

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30-09-2023 01:47

Target

c0ae6db6a8e0db7b0c7d161380549fc0.dll
Size

1.4MB
MD5

c0ae6db6a8e0db7b0c7d161380549fc0
SHA1

9ef343cdd0f2768e10220c8ff843547bc1eb3c8e
SHA256

bdea64858229772c88c92bfff9d8585554d24164e09b597cc342cd279612da0c
SHA512

0aa20fc7bbafb51f7eb6587f1edf71803264b4cdc0adc3b6b44bf9a35f19c1a5b3a61b0817b128a07ba83fc8b871dd6cbf8c23f609ec0f92f7b893729255b936
SSDEEP

12288:DF0HjI+mJJehyb4alDIwK+t8O9KS95wXwm84dcDmrk5S/P:DFCQeYvlDIdLZ0DBc/

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1756-0-0x0000000074D50000-0x0000000074E8B000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1756	2240	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0ae6db6a8e0db7b0c7d161380549fc0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0ae6db6a8e0db7b0c7d161380549fc0.dll
  2⤵
  PID:1756

memory/1756-0-0x0000000074D50000-0x0000000074E8B000-memory.dmp

Filesize
1.2MB

Download
memory/1756-1-0x0000000074D50000-0x0000000074E8B000-memory.dmp

Filesize
1.2MB

Download