dde7a509a45cad8ed5b3020117be34bcdb2546c17dc65f00377a61e7b4d5a8a1

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:25

Target
d9939a5325d92ef5f7ee01ea80c70a4a.dll
Size 743KB
Sample231222-stmzlabfa6
SHA256 dde7a509a45cad8ed5b3020117be34bcdb2546c17dc65f00377a61e7b4d5a8a1
MD5 d9939a5325d92ef5f7ee01ea80c70a4a
SHA1 2e080a030beae0649d67eaef8c68480fcb51c529
SHA512 dd9d9859b0f3c50ae35d3f84da0d2bae40f7ccaa0ea3cfe8f1a568b477802d7616a99be1c3a51feedbdf9d7b07dccbdf7eaea643127fdd2a8609c833637256d6
SSDEEP 12288:4375G4ZmrZKEfv0ACL8UhDLMNubns/YwDhyLTukPGhuzapNiB2twIdks/QI:w5G4gff1CL8UMNeGjwTu0IJZiIdRoI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2864-0-0x0000000002040000-0x00000000021F8000-memory.dmp	vmprotect
behavioral1/memory/2864-3-0x0000000002040000-0x00000000021F8000-memory.dmp	vmprotect
behavioral1/memory/2864-2-0x0000000002040000-0x00000000021F8000-memory.dmp	vmprotect
behavioral1/memory/2864-1-0x0000000002040000-0x00000000021F8000-memory.dmp	vmprotect
behavioral1/memory/2864-4-0x0000000002040000-0x00000000021F8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16
PID 3004 wrote to memory of 2864	3004	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9939a5325d92ef5f7ee01ea80c70a4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9939a5325d92ef5f7ee01ea80c70a4a.dll,#1
  2⤵
  PID:2864

memory/2864-0-0x0000000002040000-0x00000000021F8000-memory.dmp

Download

memory/2864-3-0x0000000002040000-0x00000000021F8000-memory.dmp

Download

memory/2864-2-0x0000000002040000-0x00000000021F8000-memory.dmp

Download

memory/2864-1-0x0000000002040000-0x00000000021F8000-memory.dmp

Download

memory/2864-4-0x0000000002040000-0x00000000021F8000-memory.dmp

Download