6e0f5a22072f90ef45a66e87dd93a90cb57ee2324259afd4646ffed512ee2efb

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:04

Target

NEAS.2d0a2133411bcaa920ba6f4aae8bc830.dll
Size

766KB
MD5

2d0a2133411bcaa920ba6f4aae8bc830
SHA1

5f044b64d0523e7fa9bcfa83b7be094c521cf929
SHA256

6e0f5a22072f90ef45a66e87dd93a90cb57ee2324259afd4646ffed512ee2efb
SHA512

da6430099e496e99cea15c0edfe2f0a18c3b615c09d26b8a7d0f6e1966b47b9f50f37404eba6023704ecde71c46bca8e4c5d37245a2629f7123b38a48212f24d
SSDEEP

12288:bPWV6k3y1qb2BsR8ZRjGHaz3MrBN5IjBomj3aVhsd4HdxscYlKioO4mc355eWTB:LJDuuZRjGH510jdj3LCHdZioyc3eWTB

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/836-0-0x0000000000400000-0x00000000005C2000-memory.dmp	vmprotect
behavioral2/memory/836-1-0x0000000000400000-0x00000000005C2000-memory.dmp	vmprotect
behavioral2/memory/836-2-0x0000000000400000-0x00000000005C2000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 836	4992	rundll32.exe	82
PID 4992 wrote to memory of 836	4992	rundll32.exe	82
PID 4992 wrote to memory of 836	4992	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2d0a2133411bcaa920ba6f4aae8bc830.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2d0a2133411bcaa920ba6f4aae8bc830.dll,#1
  2⤵
  PID:836

memory/836-0-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/836-1-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/836-2-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download