79740a0c91926fb77c84c4ccef7838272796a0c501bb19fc8384dc7b0b541a38

Analysis

max time kernel
150s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:45

Target

0d607302b9be5c9ab0a37ebbf281284c.dll
Size

528KB
MD5

0d607302b9be5c9ab0a37ebbf281284c
SHA1

ecf5652efd2191188b52370308343da09d6721fe
SHA256

79740a0c91926fb77c84c4ccef7838272796a0c501bb19fc8384dc7b0b541a38
SHA512

a1e54e2dca342404b44adc40cf0cbcd185d4f22ce2c3aabaaa60835f87518bb2cb7ed29c31f4c1cbc099c2091555d4642cdc3230c9679a40e9a8ca52dd6f0597
SSDEEP

12288:a0AyXY9YES8CG1mU5tz4zXRP5uBKuybOTdvP:a0AOt8r1mmc0rdv

Score

7^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3640-0-0x0000000010000000-0x000000001017E000-memory.dmp	vmprotect
behavioral2/memory/3640-1-0x0000000010000000-0x000000001017E000-memory.dmp	vmprotect
behavioral2/memory/3640-2-0x0000000010000000-0x000000001017E000-memory.dmp	vmprotect
behavioral2/memory/3640-6-0x0000000010000000-0x000000001017E000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	rundll32.exe
3640	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3640	1756	rundll32.exe	90
PID 1756 wrote to memory of 3640	1756	rundll32.exe	90
PID 1756 wrote to memory of 3640	1756	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d607302b9be5c9ab0a37ebbf281284c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d607302b9be5c9ab0a37ebbf281284c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3640

memory/3640-0-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/3640-1-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/3640-2-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/3640-6-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download