3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 02:36

Target

3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll
Size

7.5MB
MD5

e1d3f98131415e4d0badcb4021ec4452
SHA1

a51b762f267f09cead5f0f8db1fed454c8d989aa
SHA256

3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766
SHA512

9f81c373de919d92ecc7b966e3cdb97366bee4cf445059384bd2eac45f42061f6a6210c6f2944ab44cd65a9bc50aa3d688a10e13a27c3d1aabb59a9d075b2d62
SSDEEP

196608:R8gc7RwhcKK7gAUcDYHN4L0Z9uHFviaD7+NqApW7+9183MbQ:RfmRwhVFcy2JHFp2qApW721+Mc

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2628-0-0x0000000074670000-0x0000000074DEE000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2628	2052	rundll32.exe	82
PID 2052 wrote to memory of 2628	2052	rundll32.exe	82
PID 2052 wrote to memory of 2628	2052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3baad275ac155ca30433ed94822b6a8cb77f1cc12b4a3e3cbe44d87871fc4766.dll,#1
  2⤵
  PID:2628

memory/2628-0-0x0000000074670000-0x0000000074DEE000-memory.dmp

Filesize
7.5MB

Download