61a0f23a5e8482ff486dd7d8aa4d853a50f5b602dcbe371fbbdd4dca475df4f4

Analysis

max time kernel
92s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 21:45

Target
aaca9b9c6a86f1cb93a3bc2dd9c37e03.dll
Size 848KB
Sample231219-1mb8hsdda6
SHA256 61a0f23a5e8482ff486dd7d8aa4d853a50f5b602dcbe371fbbdd4dca475df4f4
MD5 aaca9b9c6a86f1cb93a3bc2dd9c37e03
SHA1 6c251558c96c72a447c62c95dd13c54f25bf154d
SHA512 3cf624c6fbf0f5652a4e7985d3333f0dc50c9c31a48a70252ff3bffbc65296db49e3ee171616b6fab492dbdbb6ea8e1a340b75b995eea0c013e0707b4201be79
SSDEEP 24576:dhTULzlDiH81/+cFwA8UVn0RTRAhcP6TgzTBvp8kMd:dhTULzlDic1/+cWVRccPlfFp8k2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3156-0-0x0000000074F20000-0x00000000750C0000-memory.dmp	vmprotect
behavioral2/memory/3156-1-0x0000000074F20000-0x00000000750C0000-memory.dmp	vmprotect
behavioral2/memory/3156-3-0x0000000074F20000-0x00000000750C0000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	3156	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3156	4624	rundll32.exe	89
PID 4624 wrote to memory of 3156	4624	rundll32.exe	89
PID 4624 wrote to memory of 3156	4624	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaca9b9c6a86f1cb93a3bc2dd9c37e03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaca9b9c6a86f1cb93a3bc2dd9c37e03.dll,#1
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 596
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3156 -ip 3156
1⤵
PID:2920

memory/3156-0-0x0000000074F20000-0x00000000750C0000-memory.dmp

Download

memory/3156-1-0x0000000074F20000-0x00000000750C0000-memory.dmp

Download

memory/3156-3-0x0000000074F20000-0x00000000750C0000-memory.dmp

Download