1da052426d8729c7b7f78af0bfd5d9da2fd9881802b39d1ddc3820632a9788c6

Analysis

max time kernel
158s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 07:09

Target

1da052426d8729c7b7f78af0bfd5d9da2fd9881802b39d1ddc3820632a9788c6.dll
Size

3.8MB
MD5

3e6c90853b8183903bfa7a47aca40e52
SHA1

b0a50903f313a81fdc2fb662c603add5bc6d2622
SHA256

1da052426d8729c7b7f78af0bfd5d9da2fd9881802b39d1ddc3820632a9788c6
SHA512

ebae9a304da46eac57ff1c22f075ac2a918358502c0e8fc70dffb4bc6f4818ee6fa4b1e46697e2a444550dc8824f27cee46dbe8034491011a4b7711d4a31a761
SSDEEP

98304:FWud4FFY0b8nu6tHZ8XKMsUefOSfeY6Yy4FPuC:Qud4zgaefhfeY6Yy4FPF

Score

7^/10

upx vmprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/784-12-0x00000000029B0000-0x00000000029BB000-memory.dmp	upx
behavioral2/memory/784-14-0x00000000029B0000-0x00000000029BB000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/784-0-0x0000000010000000-0x00000000108AB000-memory.dmp	vmprotect
behavioral2/memory/784-15-0x0000000010000000-0x00000000108AB000-memory.dmp	vmprotect
behavioral2/memory/784-16-0x0000000010000000-0x00000000108AB000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
784	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 784	2692	rundll32.exe	86
PID 2692 wrote to memory of 784	2692	rundll32.exe	86
PID 2692 wrote to memory of 784	2692	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1da052426d8729c7b7f78af0bfd5d9da2fd9881802b39d1ddc3820632a9788c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1da052426d8729c7b7f78af0bfd5d9da2fd9881802b39d1ddc3820632a9788c6.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:784

memory/784-0-0x0000000010000000-0x00000000108AB000-memory.dmp

Filesize
8.7MB

Download
memory/784-1-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/784-2-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/784-3-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/784-4-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/784-5-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/784-6-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/784-8-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/784-12-0x00000000029B0000-0x00000000029BB000-memory.dmp

Filesize
44KB

Download
memory/784-13-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/784-14-0x00000000029B0000-0x00000000029BB000-memory.dmp

Filesize
44KB

Download
memory/784-15-0x0000000010000000-0x00000000108AB000-memory.dmp

Filesize
8.7MB

Download
memory/784-16-0x0000000010000000-0x00000000108AB000-memory.dmp

Filesize
8.7MB

Download