31aedde8e59bba6d0c41b681352c797500e48ba842e6cd6f409168ee8bc4c96c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:46

Target

076c4667df9e8494015ab8a38e9bfdbf.dll
Size

67KB
MD5

076c4667df9e8494015ab8a38e9bfdbf
SHA1

2f6944051fcaf94b84052c733c626d12857d6b4a
SHA256

31aedde8e59bba6d0c41b681352c797500e48ba842e6cd6f409168ee8bc4c96c
SHA512

b299053eeb4418c51196957c4d2bcbeed0aedab3ff5bc7db98b09f6ab7c188dddbbde16c8e486724ec6e9201af25f71fcb01dd76e8310ea55d8946cad17f1164
SSDEEP

1536:e+oBl4RfxEh4/CgHpHsiHdeiVmO2CZ1+h0ZQaiHhZ6plJd:e+oBEfxEh46gHpMigdCAIiBZ6pl3

Score

7^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2292-0-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect
behavioral1/memory/2292-1-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect
behavioral1/memory/2292-2-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect
behavioral1/memory/2292-3-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c4667df9e8494015ab8a38e9bfdbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c4667df9e8494015ab8a38e9bfdbf.dll,#1
  2⤵
  PID:2292

memory/2292-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/2292-1-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/2292-2-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/2292-3-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download