e8a8923baae2be9af8b62d313ed17d613cd8011cd8756412312e441fa57658f5

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 15:23

Target
d66cdad28b7b29df617a9783c32b0063.dll
Size 738KB
Sample231220-ssgfeshcb4
SHA256 e8a8923baae2be9af8b62d313ed17d613cd8011cd8756412312e441fa57658f5
MD5 d66cdad28b7b29df617a9783c32b0063
SHA1 ee54cbd8edca68df0e83683425058c08e45ec7fb
SHA512 6152c3a18bcebdac0ab76e7b7e17645d94a2404244125de48887f985027e636893b64032b53207c18786aa5718f6c3e843dc0115f5c2be7f9414aaf649c1d92d
SSDEEP 12288:rOjXfoXQkAYH8ENH+R527a3YlbpTaKra0cQXBnmAMWtJkPSCzVt:rOEgkAYH8EK5nIRpTaYfcAmfWzkTt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2912-0-0x00000000021D0000-0x0000000002386000-memory.dmp	vmprotect
behavioral1/memory/2912-1-0x00000000021D0000-0x0000000002386000-memory.dmp	vmprotect
behavioral1/memory/2912-2-0x00000000021D0000-0x0000000002386000-memory.dmp	vmprotect
behavioral1/memory/2912-4-0x00000000021D0000-0x0000000002386000-memory.dmp	vmprotect
behavioral1/memory/2912-5-0x00000000021D0000-0x0000000002386000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66cdad28b7b29df617a9783c32b0063.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66cdad28b7b29df617a9783c32b0063.dll,#1
  2⤵
  PID:2912

memory/2912-0-0x00000000021D0000-0x0000000002386000-memory.dmp

Download

memory/2912-1-0x00000000021D0000-0x0000000002386000-memory.dmp

Download

memory/2912-2-0x00000000021D0000-0x0000000002386000-memory.dmp

Download

memory/2912-4-0x00000000021D0000-0x0000000002386000-memory.dmp

Download

memory/2912-5-0x00000000021D0000-0x0000000002386000-memory.dmp

Download