6b2067b87d32493084912d55af0b6c69593428e7525a2803087c0c8bfd3ccc28

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:53

Target

06b895b9124d0e5f3d2b41bd6a72cc51.dll
Size

627KB
MD5

06b895b9124d0e5f3d2b41bd6a72cc51
SHA1

a33d95c4e4f5c4e1884befb9e4bccd6a33a64598
SHA256

6b2067b87d32493084912d55af0b6c69593428e7525a2803087c0c8bfd3ccc28
SHA512

622402f7d65c714b9ee5cd956b597012df5b42538bf5b21e0ffbdbefd284a23f273db3b400826ea94d51fd344ded92f0a5e3f41a33b869579e8f67f9e356eff9
SSDEEP

12288:2RE2jFJiDOIRkVV+9OhCGeBjPqRUlRpDBT0+On2xqX3Ca36G0ZS9keTV:2e+wiI+7OG6LqRUrpDBehXSNG0Zuk4

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3088-0-0x0000000010000000-0x00000000100DE000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3088	1912	rundll32.exe	14
PID 1912 wrote to memory of 3088	1912	rundll32.exe	14
PID 1912 wrote to memory of 3088	1912	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b895b9124d0e5f3d2b41bd6a72cc51.dll,#1
1⤵
PID:3088

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b895b9124d0e5f3d2b41bd6a72cc51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

memory/3088-0-0x0000000010000000-0x00000000100DE000-memory.dmp

Filesize
888KB

Download