9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:29

Target

8c145eb875f43b858165976bd3e556ab.dll
Size

747KB
MD5

8c145eb875f43b858165976bd3e556ab
SHA1

8fd95103999bbbc655f9781a73553798331c6594
SHA256

9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba
SHA512

6560071c99f9a2d1d4ff1a6520213b0898ba4e7f3805514efdc5c2d91765b4f504134e97c6a8877c665898a11423b2ccd233dde6a3087f5f9b4c5460ae5b17a2
SSDEEP

12288:irTmzUHgoZ4wcY6mN9ELoGd/VVz7V8KEpKIeyqEJtK8UeJixjFNehis3bKy:sIUH0wx6mN9ELH/TF8K2KBydJgPxQ+y

Score

7^/10

vmprotect

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2148-1-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect
behavioral1/memory/2148-4-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect
behavioral1/memory/2148-3-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect
behavioral1/memory/2148-2-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect
behavioral1/memory/2148-0-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect
behavioral1/memory/2148-5-0x0000000002260000-0x0000000002419000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14
PID 1660 wrote to memory of 2148	1660	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#1
1⤵
PID:2148

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

memory/2148-1-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download
memory/2148-4-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download
memory/2148-3-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download
memory/2148-2-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download
memory/2148-0-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download
memory/2148-5-0x0000000002260000-0x0000000002419000-memory.dmp

Filesize
1.7MB

Download