8b6b3e9f77a15730c642aeb7b47691e084bbfffef4def9c069b37ec6802ec33a

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 00:49

Target

VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK32.dll
Size

98KB
MD5

42bc27a67b8d922ff86699723d546f4a
SHA1

f74a57e5d48ae45bbe72e3d212cfef08f44bddea
SHA256

ffa66ecc900b58b2f0b99f70edd7af9c7232cea067716842d3b2dc56e396a7f0
SHA512

66a8cc93ae0db170c9afd9554944bc6af7306e5e628178c2371196c7007aafde733d1548aaa62e6795dfd45f0563930565fcf1bfd2ff6010ae562a0c16ea9898
SSDEEP

1536:3T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwX0YXowGF:phQC2mCYK3RhrZ9dPk2Q9yMJwX0YRG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30
PID 2712 wrote to memory of 2732	2712	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectSDK32.dll,#1
  2⤵
  PID:2732