3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 02:36

Target

3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll
Size

7.5MB
MD5

e1d3f98131415e4d0badcb4021ec4452
SHA1

a51b762f267f09cead5f0f8db1fed454c8d989aa
SHA256

3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766
SHA512

9f81c373de919d92ecc7b966e3cdb97366bee4cf445059384bd2eac45f42061f6a6210c6f2944ab44cd65a9bc50aa3d688a10e13a27c3d1aabb59a9d075b2d62
SSDEEP

196608:R8gc7RwhcKK7gAUcDYHN4L0Z9uHFviaD7+NqApW7+9183MbQ:RfmRwhVFcy2JHFp2qApW721+Mc

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2900-0-0x0000000074BD0000-0x000000007534E000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28
PID 1956 wrote to memory of 2900	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll,#1
  2⤵
  PID:2900

memory/2900-0-0x0000000074BD0000-0x000000007534E000-memory.dmp

Filesize
7.5MB

Download
memory/2900-1-0x0000000074BD0000-0x000000007534E000-memory.dmp

Filesize
7.5MB

Download
memory/2900-2-0x0000000073B50000-0x00000000742CE000-memory.dmp

Filesize
7.5MB

Download
memory/2900-3-0x0000000073B50000-0x00000000742CE000-memory.dmp

Filesize
7.5MB

Download