c9412f7c2c8abcf935e4f4ac102192b7c145aff76d3714740842267c6c883ed7

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 21:25

Target

c9412f7c2c8abcf935e4f4ac102192b7c145aff76d3714740842267c6c883ed7.dll
Size

5.0MB
MD5

0bb57ee2193072052b154f3f48c2eb1c
SHA1

185b40e23b0a203ce0e0a9e0639d0f5748f949c4
SHA256

c9412f7c2c8abcf935e4f4ac102192b7c145aff76d3714740842267c6c883ed7
SHA512

89dd75f780660674f797806f019dc3475363273d221045e2c796f72e60901a51a979e3f6162cc1a13d7b85ca591f675d4e19ff97c54be9d2186181207e9f6c4f
SSDEEP

98304:rb2jE/9izE5txWclDavzhV/g+Mb+yQICWIAm2B4B46xynZ+58:rmE73Duz7RMgICWRmsF68n

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4060-0-0x0000000074900000-0x0000000074DF7000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4060	3068	rundll32.exe	85
PID 3068 wrote to memory of 4060	3068	rundll32.exe	85
PID 3068 wrote to memory of 4060	3068	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9412f7c2c8abcf935e4f4ac102192b7c145aff76d3714740842267c6c883ed7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9412f7c2c8abcf935e4f4ac102192b7c145aff76d3714740842267c6c883ed7.dll,#1
  2⤵
  PID:4060

memory/4060-0-0x0000000074900000-0x0000000074DF7000-memory.dmp

Filesize
5.0MB

Download