31aedde8e59bba6d0c41b681352c797500e48ba842e6cd6f409168ee8bc4c96c

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:46

Target

076c4667df9e8494015ab8a38e9bfdbf.dll
Size

67KB
MD5

076c4667df9e8494015ab8a38e9bfdbf
SHA1

2f6944051fcaf94b84052c733c626d12857d6b4a
SHA256

31aedde8e59bba6d0c41b681352c797500e48ba842e6cd6f409168ee8bc4c96c
SHA512

b299053eeb4418c51196957c4d2bcbeed0aedab3ff5bc7db98b09f6ab7c188dddbbde16c8e486724ec6e9201af25f71fcb01dd76e8310ea55d8946cad17f1164
SSDEEP

1536:e+oBl4RfxEh4/CgHpHsiHdeiVmO2CZ1+h0ZQaiHhZ6plJd:e+oBEfxEh46gHpMigdCAIiBZ6pl3

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4628-0-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect
behavioral2/memory/4628-2-0x0000000010000000-0x000000001002B000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4628	4336	rundll32.exe	47
PID 4336 wrote to memory of 4628	4336	rundll32.exe	47
PID 4336 wrote to memory of 4628	4336	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c4667df9e8494015ab8a38e9bfdbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c4667df9e8494015ab8a38e9bfdbf.dll,#1
  2⤵
  PID:4628

memory/4628-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/4628-1-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4628-2-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download