80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a

Analysis

max time kernel
111s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 03:39

Target

80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll
Size

8.7MB
MD5

1bf568a152da100ce29d3fb13cf0f6d2
SHA1

4ace99ae7a1fa711eff86691dd77783abd86761a
SHA256

80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a
SHA512

80e4f8e51da9398952314f0ce3407e24d746a998c24eacb26ed6f1067a1413a7a0bb2c5563966cd704b8e1a433054e75cf06f748c4c44ed9551feda3c6059998
SSDEEP

98304:pnR03PIXOWDUaSuIlH7JPaD2/eklbopO/5owtWk8U8U0POFTeHCYYFt3f0xyVfwA:pRreWDIldi8ypfUz8XOFTIYj3cw5wo9V

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3360-0-0x0000000010000000-0x00000000108BC000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3360	1080	rundll32.exe	87
PID 1080 wrote to memory of 3360	1080	rundll32.exe	87
PID 1080 wrote to memory of 3360	1080	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#1
  2⤵
  PID:3360

memory/3360-0-0x0000000010000000-0x00000000108BC000-memory.dmp

Filesize
8.7MB

Download