bdea64858229772c88c92bfff9d8585554d24164e09b597cc342cd279612da0c

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2023 01:47

Target

c0ae6db6a8e0db7b0c7d161380549fc0.dll
Size

1.4MB
MD5

c0ae6db6a8e0db7b0c7d161380549fc0
SHA1

9ef343cdd0f2768e10220c8ff843547bc1eb3c8e
SHA256

bdea64858229772c88c92bfff9d8585554d24164e09b597cc342cd279612da0c
SHA512

0aa20fc7bbafb51f7eb6587f1edf71803264b4cdc0adc3b6b44bf9a35f19c1a5b3a61b0817b128a07ba83fc8b871dd6cbf8c23f609ec0f92f7b893729255b936
SSDEEP

12288:DF0HjI+mJJehyb4alDIwK+t8O9KS95wXwm84dcDmrk5S/P:DFCQeYvlDIdLZ0DBc/

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/5088-0-0x0000000074A60000-0x0000000074B9B000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 5088	2548	regsvr32.exe	85
PID 2548 wrote to memory of 5088	2548	regsvr32.exe	85
PID 2548 wrote to memory of 5088	2548	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0ae6db6a8e0db7b0c7d161380549fc0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0ae6db6a8e0db7b0c7d161380549fc0.dll
  2⤵
  PID:5088

memory/5088-0-0x0000000074A60000-0x0000000074B9B000-memory.dmp

Filesize
1.2MB

Download