9a8a9402becb99cb5cec7fa66add793f4b178a9cfca6345f2954edcff65e9bcd

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 10:03

Target

9a8a9402becb99cb5cec7fa66add793f4b178a9cfca6345f2954edcff65e9bcd.dll
Size

6.8MB
MD5

03748caed221a092705a93bb94126f1c
SHA1

7e273375f8a183e22aa775d472bd7a88b4e6f59a
SHA256

9a8a9402becb99cb5cec7fa66add793f4b178a9cfca6345f2954edcff65e9bcd
SHA512

620599f7ea187ae00335cde7a7a27a9cf25a4fd8f8104cb18be3b059bd2eee4707de353e5fd45abc8831f55f43935f0be8e6da8d8ee9c6647c649e7975a3f5e8
SSDEEP

196608:yy5NQBT9i8hoZvFz1Uk5y7C1p2n8Vkezrj:yyNSzoBcaVJj

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2380-3-0x0000000072E20000-0x0000000073C70000-memory.dmp	vmprotect
behavioral1/memory/2380-4-0x0000000072E20000-0x0000000073C70000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28
PID 1372 wrote to memory of 2380	1372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a8a9402becb99cb5cec7fa66add793f4b178a9cfca6345f2954edcff65e9bcd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a8a9402becb99cb5cec7fa66add793f4b178a9cfca6345f2954edcff65e9bcd.dll,#1
  2⤵
  PID:2380

memory/2380-0-0x0000000074090000-0x0000000074EE0000-memory.dmp

Filesize
14.3MB

Download
memory/2380-1-0x0000000072E20000-0x0000000073C70000-memory.dmp

Filesize
14.3MB

Download
memory/2380-2-0x0000000074090000-0x0000000074EE0000-memory.dmp

Filesize
14.3MB

Download
memory/2380-3-0x0000000072E20000-0x0000000073C70000-memory.dmp

Filesize
14.3MB

Download
memory/2380-4-0x0000000072E20000-0x0000000073C70000-memory.dmp

Filesize
14.3MB

Download