f8802ba622e9ac17e547aeba6e939251c4cd5a995d2ffee0d14327c4b03c2908

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 19:04

Target

f8802ba622e9ac17e547aeba6e939251c4cd5a995d2ffee0d14327c4b03c2908.dll
Size

5.2MB
MD5

74a185e067aaea407f08578905c10c9d
SHA1

0e1dd48f66babf47c81bbcaf1065915819238411
SHA256

f8802ba622e9ac17e547aeba6e939251c4cd5a995d2ffee0d14327c4b03c2908
SHA512

83602617bcc5ee70ebc220b2f3dad4d47a070b3600e5e32725b12edb5894804c4dfb479ad3ac1820fcc708a8da108ce5aa74c58e58013cbbbd2ce44b19c50684
SSDEEP

98304:Tmire5JkKdsRZedB6MAanOKUltfziFYsLtVKtgBrEzWCSHX3MaXBlDujRLn:Tw5JkR4dEMBOJlhO7X0gBAzWCKX3J2

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1732-0-0x00000000747F0000-0x0000000074D28000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28
PID 1704 wrote to memory of 1732	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8802ba622e9ac17e547aeba6e939251c4cd5a995d2ffee0d14327c4b03c2908.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8802ba622e9ac17e547aeba6e939251c4cd5a995d2ffee0d14327c4b03c2908.dll,#1
  2⤵
  PID:1732

memory/1732-0-0x00000000747F0000-0x0000000074D28000-memory.dmp

Filesize
5.2MB

Download
memory/1732-2-0x00000000742B0000-0x00000000747E8000-memory.dmp

Filesize
5.2MB

Download
memory/1732-1-0x00000000747F0000-0x0000000074D28000-memory.dmp

Filesize
5.2MB

Download