1e9d1c61c6fcaf30e4c4137911422ce718c0587d52fdbb0bb33d0ab1b40ec32e

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 17:06

Target

1e9d1c61c6fcaf30e4c4137911422ce718c0587d52fdbb0bb33d0ab1b40ec32e.dll
Size

7.5MB
MD5

f2b7d5113430e1de524d1952decc5c25
SHA1

8f2d05c3f188674386a7d7c95553277049d58eb9
SHA256

1e9d1c61c6fcaf30e4c4137911422ce718c0587d52fdbb0bb33d0ab1b40ec32e
SHA512

0cc7ff48f1c7a0d15fd27a925050f4e704aba6df985aacf7e3b74cbb9ce89c28ab99e13a96c95fd0062d9f1ee2eeeeffec472ef2c0bcc78e0c54088888df84dc
SSDEEP

196608:SG4lHqMDmH8s2mHsQI93V1DU+fQLXGPNB65o2En2/An:SGAD6d8Q+EXYB65DA/

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1032-0-0x0000000010000000-0x0000000011048000-memory.dmp	vmprotect
behavioral2/memory/1032-9-0x0000000010000000-0x0000000011048000-memory.dmp	vmprotect
behavioral2/memory/1032-21-0x0000000010000000-0x0000000011048000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DATAs\µôÏßÖØÁ¬¼ÇÂ¼.txt	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1032	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	rundll32.exe

Suspicious use of SetWindowsHookEx 29 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1032	2356	rundll32.exe	85
PID 2356 wrote to memory of 1032	2356	rundll32.exe	85
PID 2356 wrote to memory of 1032	2356	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e9d1c61c6fcaf30e4c4137911422ce718c0587d52fdbb0bb33d0ab1b40ec32e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e9d1c61c6fcaf30e4c4137911422ce718c0587d52fdbb0bb33d0ab1b40ec32e.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1032

memory/1032-0-0x0000000010000000-0x0000000011048000-memory.dmp

Filesize
16.3MB

Download
memory/1032-1-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/1032-2-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/1032-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1032-4-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1032-5-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1032-6-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/1032-7-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1032-8-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1032-9-0x0000000010000000-0x0000000011048000-memory.dmp

Filesize
16.3MB

Download
memory/1032-21-0x0000000010000000-0x0000000011048000-memory.dmp

Filesize
16.3MB

Download