8b6b3e9f77a15730c642aeb7b47691e084bbfffef4def9c069b37ec6802ec33a

Analysis

max time kernel
134s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 00:49

Target

VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK32.dll
Size

98KB
MD5

42bc27a67b8d922ff86699723d546f4a
SHA1

f74a57e5d48ae45bbe72e3d212cfef08f44bddea
SHA256

ffa66ecc900b58b2f0b99f70edd7af9c7232cea067716842d3b2dc56e396a7f0
SHA512

66a8cc93ae0db170c9afd9554944bc6af7306e5e628178c2371196c7007aafde733d1548aaa62e6795dfd45f0563930565fcf1bfd2ff6010ae562a0c16ea9898
SSDEEP

1536:3T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwX0YXowGF:phQC2mCYK3RhrZ9dPk2Q9yMJwX0YRG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	1608	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1608	3864	rundll32.exe	88
PID 3864 wrote to memory of 1608	3864	rundll32.exe	88
PID 3864 wrote to memory of 1608	3864	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectSDK32.dll,#1
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 600
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
1⤵
PID:4396