e8a8923baae2be9af8b62d313ed17d613cd8011cd8756412312e441fa57658f5

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 15:23

Target
d66cdad28b7b29df617a9783c32b0063.dll
Size 738KB
Sample231220-ssgfeshcb4
SHA256 e8a8923baae2be9af8b62d313ed17d613cd8011cd8756412312e441fa57658f5
MD5 d66cdad28b7b29df617a9783c32b0063
SHA1 ee54cbd8edca68df0e83683425058c08e45ec7fb
SHA512 6152c3a18bcebdac0ab76e7b7e17645d94a2404244125de48887f985027e636893b64032b53207c18786aa5718f6c3e843dc0115f5c2be7f9414aaf649c1d92d
SSDEEP 12288:rOjXfoXQkAYH8ENH+R527a3YlbpTaKra0cQXBnmAMWtJkPSCzVt:rOEgkAYH8EK5nIRpTaYfcAmfWzkTt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x00000000005B6000-memory.dmp	vmprotect
behavioral2/memory/1456-1-0x0000000000400000-0x00000000005B6000-memory.dmp	vmprotect
behavioral2/memory/1456-2-0x0000000000400000-0x00000000005B6000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 1456	3088	rundll32.exe	86
PID 3088 wrote to memory of 1456	3088	rundll32.exe	86
PID 3088 wrote to memory of 1456	3088	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66cdad28b7b29df617a9783c32b0063.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66cdad28b7b29df617a9783c32b0063.dll,#1
  2⤵
  PID:1456

memory/1456-0-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/1456-1-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/1456-2-0x0000000000400000-0x00000000005B6000-memory.dmp

Download