135cec77da006610f50a3ccf1fba4555dccb79b5f21ee0361a04dfc1e074f6d6

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 13:13

Target

135cec77da006610f50a3ccf1fba4555dccb79b5f21ee0361a04dfc1e074f6d6.dll
Size

280KB
MD5

25ccec2c3723c385c4dd9aa4845674b0
SHA1

ef2d8420da7d8ef874d0cd5c0beb65ebc16ccbe5
SHA256

135cec77da006610f50a3ccf1fba4555dccb79b5f21ee0361a04dfc1e074f6d6
SHA512

6097cb5f362c9e4ec22d1bc5623fc4612d92509c36a9840ea1caf63fb0e1812dc0aed474d97803ff13ad78c252b44b457c1eb4d3a59c5aa6ed1dcb3b75cdc546
SSDEEP

6144:PCnnVepEccfMs2+ore1VaTEBBlgshyXcwiVzgaOzBkoYekBod1ak:anVe6B0f+oS1Va8n4JFBkoY7Bod1a

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2128-0-0x0000000010000000-0x000000001009D000-memory.dmp	vmprotect
behavioral1/memory/2128-1-0x0000000010000000-0x000000001009D000-memory.dmp	vmprotect
behavioral1/memory/2128-4-0x0000000010000000-0x000000001009D000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2128 rundll32.exe
2128 rundll32.exe

pid	process
2128	rundll32.exe
2128	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2128	2236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\135cec77da006610f50a3ccf1fba4555dccb79b5f21ee0361a04dfc1e074f6d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\135cec77da006610f50a3ccf1fba4555dccb79b5f21ee0361a04dfc1e074f6d6.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128

memory/2128-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/2128-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/2128-4-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download