dd3c32296a1aa8fa1ea7f934cfb0a04b05c6e0e9bf99261057efe3b8813772a6

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:58

Target
049b93440d0662c6f0bea1db1dc29b92.dll
Size 684KB
Sample231224-tevxbsgcbk
SHA256 dd3c32296a1aa8fa1ea7f934cfb0a04b05c6e0e9bf99261057efe3b8813772a6
MD5 049b93440d0662c6f0bea1db1dc29b92
SHA1 1e226ab523f8dbd87fbebc5b981622468e6ca01c
SHA512 37a79f71025f56a61f8353279370fc85b14444c0e9e15c25b37a5317b477eb424ffcfae86dca7ab7b5821c93f45e0c6c79148e3049f1c151a7c58b040c496d6f
SSDEEP 12288:Pcr15LU3/bZ8fyOYA0rw7qzPHJmJTGpEgdnxv3u3vIycv3A/S4cI3wEYGS:+15U3jSfyOYA0cOIti+vITARw6S
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1756-0-0x0000000010000000-0x0000000010110000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1756	4680	rundll32.exe	15
PID 4680 wrote to memory of 1756	4680	rundll32.exe	15
PID 4680 wrote to memory of 1756	4680	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049b93440d0662c6f0bea1db1dc29b92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\049b93440d0662c6f0bea1db1dc29b92.dll,#1
  2⤵
  PID:1756

memory/1756-0-0x0000000010000000-0x0000000010110000-memory.dmp

Download