822694f023dd1649ccbe49e152c236766fe44a3bac927edf6d354e9cf1599d09

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 05:51

Target

822694f023dd1649ccbe49e152c236766fe44a3bac927edf6d354e9cf1599d09.dll
Size

7.8MB
MD5

7123647c284e51344dec93e05782d536
SHA1

05a3f38d432c145637668d944c0cb68812a245d7
SHA256

822694f023dd1649ccbe49e152c236766fe44a3bac927edf6d354e9cf1599d09
SHA512

4b60b94a7131d979fb3e2f2687cadf15267f93bce8717dc7e3bc129b3af9789eee29807787e8abaa8d4c0ba12a56840c63fdae96114d1b4391935ff7f097ace4
SSDEEP

196608:hLf11o+2L69W0GEdzyCP1wXTSczvRy4x:hLt1x9W4NttuA4

Score

7^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2108-0-0x0000000180000000-0x0000000180DF4000-memory.dmp	vmprotect
behavioral1/memory/2108-2-0x0000000180000000-0x0000000180DF4000-memory.dmp	vmprotect
behavioral1/memory/2108-3-0x0000000180000000-0x0000000180DF4000-memory.dmp	vmprotect
behavioral1/memory/2108-6-0x0000000180000000-0x0000000180DF4000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2108	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2412	2108	rundll32.exe	28
PID 2108 wrote to memory of 2412	2108	rundll32.exe	28
PID 2108 wrote to memory of 2412	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\822694f023dd1649ccbe49e152c236766fe44a3bac927edf6d354e9cf1599d09.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 204
  2⤵
  PID:2412

memory/2108-0-0x0000000180000000-0x0000000180DF4000-memory.dmp

Filesize
14.0MB

Download
memory/2108-2-0x0000000180000000-0x0000000180DF4000-memory.dmp

Filesize
14.0MB

Download
memory/2108-3-0x0000000180000000-0x0000000180DF4000-memory.dmp

Filesize
14.0MB

Download
memory/2108-6-0x0000000180000000-0x0000000180DF4000-memory.dmp

Filesize
14.0MB

Download