9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba

Analysis

max time kernel
141s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:29

Target

8c145eb875f43b858165976bd3e556ab.dll
Size

747KB
MD5

8c145eb875f43b858165976bd3e556ab
SHA1

8fd95103999bbbc655f9781a73553798331c6594
SHA256

9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba
SHA512

6560071c99f9a2d1d4ff1a6520213b0898ba4e7f3805514efdc5c2d91765b4f504134e97c6a8877c665898a11423b2ccd233dde6a3087f5f9b4c5460ae5b17a2
SSDEEP

12288:irTmzUHgoZ4wcY6mN9ELoGd/VVz7V8KEpKIeyqEJtK8UeJixjFNehis3bKy:sIUH0wx6mN9ELH/TF8K2KBydJgPxQ+y

Score

7^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1168-0-0x00000000023D0000-0x0000000002589000-memory.dmp	vmprotect
behavioral2/memory/1168-2-0x00000000023D0000-0x0000000002589000-memory.dmp	vmprotect
behavioral2/memory/1168-1-0x00000000023D0000-0x0000000002589000-memory.dmp	vmprotect
behavioral2/memory/1168-3-0x00000000023D0000-0x0000000002589000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1168	3864	rundll32.exe	14
PID 3864 wrote to memory of 1168	3864	rundll32.exe	14
PID 3864 wrote to memory of 1168	3864	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#1
1⤵
PID:1168

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864

memory/1168-0-0x00000000023D0000-0x0000000002589000-memory.dmp

Filesize
1.7MB

Download
memory/1168-2-0x00000000023D0000-0x0000000002589000-memory.dmp

Filesize
1.7MB

Download
memory/1168-1-0x00000000023D0000-0x0000000002589000-memory.dmp

Filesize
1.7MB

Download
memory/1168-3-0x00000000023D0000-0x0000000002589000-memory.dmp

Filesize
1.7MB

Download