a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 07:30

Target

a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll
Size

7.5MB
MD5

0ae888091cfa03ff7b04d1ff438aede1
SHA1

b9826c255b11fec46e6ab0ce85b28788b1d0df40
SHA256

a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542
SHA512

e02914b7e67fbd29a586b76affa66d856c8d362339c93730d1c1f53c2fead4ee1affbb91e76faed6b19e974ee9083e85212f13f296fa49e922fd96e17cb063a5
SSDEEP

98304:/jeQN+04QGuQzXh1OG6UC9s+MzHDzgT0WlDFmIiQutQlLk1laDB6DQHNVBcVS06O:4pV1OG6UCmGTvuOggDBOIVSB6zZQ

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2072-0-0x0000000074D10000-0x000000007548E000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28
PID 3028 wrote to memory of 2072	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll,#1
  2⤵
  PID:2072

memory/2072-0-0x0000000074D10000-0x000000007548E000-memory.dmp

Filesize
7.5MB

Download
memory/2072-1-0x0000000074D10000-0x000000007548E000-memory.dmp

Filesize
7.5MB

Download
memory/2072-2-0x0000000074590000-0x0000000074D0E000-memory.dmp

Filesize
7.5MB

Download
memory/2072-3-0x0000000074590000-0x0000000074D0E000-memory.dmp

Filesize
7.5MB

Download