1acebda3702a0675ffbbc16bff0b99bd7d4402d690919e26ee24d18e60c4602f

Analysis

max time kernel
141s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:50

Target

04dbdcb8f9634289f70e49718a508090.dll
Size

611KB
MD5

04dbdcb8f9634289f70e49718a508090
SHA1

78964fb92ba234601094dd142c6fe635c4c6fe7e
SHA256

1acebda3702a0675ffbbc16bff0b99bd7d4402d690919e26ee24d18e60c4602f
SHA512

a00e05f6dfd29828c52a189ce777c904e3cd6e93c0e7ce814f5bfd2af7c4d8302006734b708f252965cd7645094093383565ae408b0d449ddfcfc5c4e55af2e0
SSDEEP

12288:o5yMrLVmeIqzPHJmJTGpEgdnxv3u3vIycvKEEBo4njUc+Yy:9IrXIti+vIFknjU1

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4088-0-0x0000000010000000-0x00000000100E8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4088	2972	rundll32.exe	14
PID 2972 wrote to memory of 4088	2972	rundll32.exe	14
PID 2972 wrote to memory of 4088	2972	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04dbdcb8f9634289f70e49718a508090.dll,#1
1⤵
PID:4088

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04dbdcb8f9634289f70e49718a508090.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972

memory/4088-0-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download