80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 03:39

Target

80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll
Size

8.7MB
MD5

1bf568a152da100ce29d3fb13cf0f6d2
SHA1

4ace99ae7a1fa711eff86691dd77783abd86761a
SHA256

80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a
SHA512

80e4f8e51da9398952314f0ce3407e24d746a998c24eacb26ed6f1067a1413a7a0bb2c5563966cd704b8e1a433054e75cf06f748c4c44ed9551feda3c6059998
SSDEEP

98304:pnR03PIXOWDUaSuIlH7JPaD2/eklbopO/5owtWk8U8U0POFTeHCYYFt3f0xyVfwA:pRreWDIldi8ypfUz8XOFTIYj3cw5wo9V

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/3048-0-0x0000000010000000-0x00000000108BC000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28
PID 2988 wrote to memory of 3048	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#1
  2⤵
  PID:3048

memory/3048-0-0x0000000010000000-0x00000000108BC000-memory.dmp

Filesize
8.7MB

Download
memory/3048-1-0x0000000010000000-0x00000000108BC000-memory.dmp

Filesize
8.7MB

Download
memory/3048-2-0x0000000010000000-0x00000000108BC000-memory.dmp

Filesize
8.7MB

Download
memory/3048-3-0x0000000010000000-0x00000000108BC000-memory.dmp

Filesize
8.7MB

Download