e1c8f4471575520e91aadb8413835041813e09aa75c8fed804327b96f03a557f

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 20:56

Target

e1c8f4471575520e91aadb8413835041813e09aa75c8fed804327b96f03a557f.dll
Size

8.7MB
MD5

2ca3d4161cb98af4ad27898c7370f798
SHA1

74bde39bb2370704f92ee49cf39844c4fdbaa2c8
SHA256

e1c8f4471575520e91aadb8413835041813e09aa75c8fed804327b96f03a557f
SHA512

0000ac330b16820f2a2b4847db825fbd8244ace9f098b1388845a1d83a8c945dd0357484533cfc190bc5273139b20e8912c01e8587795af65b94f31147b79d18
SSDEEP

196608:AqWbxecDEsWGcNBe9Ea2EyM7L0ep/9gOKV7Y0K0Cyb:7hgrZJv799gx609C4

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/5100-0-0x0000000010000000-0x00000000108B6000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5100	2340	rundll32.exe	86
PID 2340 wrote to memory of 5100	2340	rundll32.exe	86
PID 2340 wrote to memory of 5100	2340	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1c8f4471575520e91aadb8413835041813e09aa75c8fed804327b96f03a557f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1c8f4471575520e91aadb8413835041813e09aa75c8fed804327b96f03a557f.dll,#1
  2⤵
  PID:5100

memory/5100-0-0x0000000010000000-0x00000000108B6000-memory.dmp

Filesize
8.7MB

Download