a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542

Analysis

max time kernel
117s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 07:30

Target

a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll
Size

7.5MB
MD5

0ae888091cfa03ff7b04d1ff438aede1
SHA1

b9826c255b11fec46e6ab0ce85b28788b1d0df40
SHA256

a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542
SHA512

e02914b7e67fbd29a586b76affa66d856c8d362339c93730d1c1f53c2fead4ee1affbb91e76faed6b19e974ee9083e85212f13f296fa49e922fd96e17cb063a5
SSDEEP

98304:/jeQN+04QGuQzXh1OG6UC9s+MzHDzgT0WlDFmIiQutQlLk1laDB6DQHNVBcVS06O:4pV1OG6UCmGTvuOggDBOIVSB6zZQ

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2044-0-0x00000000744A0000-0x0000000074C1E000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2044	2720	rundll32.exe	85
PID 2720 wrote to memory of 2044	2720	rundll32.exe	85
PID 2720 wrote to memory of 2044	2720	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a97768285abb6777865e140b6e689ff2260178e9cec7efdfc3f77588cd54c542.dll,#1
  2⤵
  PID:2044

memory/2044-0-0x00000000744A0000-0x0000000074C1E000-memory.dmp

Filesize
7.5MB

Download