c1a38f93d41e778c56688071dcf1f7edb6f44c086015dd45bca685c0d0fea04f

Analysis

max time kernel
146s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:55

Target

2255ca005c53772f465a13adfa24c092.dll
Size

741KB
MD5

2255ca005c53772f465a13adfa24c092
SHA1

a5166c36538f276d1e58ccb3f2da62022fb321b0
SHA256

c1a38f93d41e778c56688071dcf1f7edb6f44c086015dd45bca685c0d0fea04f
SHA512

65427b03a1e7829968103db06916df55ae8f7633019dd677bd86067bd61a3d5cf8905fd611e05f691199b98944b0c74de10a796a2816daa32085b20089b81c74
SSDEEP

12288:esAoRjKU5BMEPxTHF80wzhGVEyBaZAIZez62qCC2syDEbTeIa7m:jRZ5B75THFeYVE/XGrpnYpaa

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1964-0-0x0000000000400000-0x00000000005B7000-memory.dmp	vmprotect
behavioral2/memory/1964-1-0x0000000000400000-0x00000000005B7000-memory.dmp	vmprotect
behavioral2/memory/1964-2-0x0000000000400000-0x00000000005B7000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1964	2496	rundll32.exe	16
PID 2496 wrote to memory of 1964	2496	rundll32.exe	16
PID 2496 wrote to memory of 1964	2496	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2255ca005c53772f465a13adfa24c092.dll,#1
1⤵
PID:1964

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2255ca005c53772f465a13adfa24c092.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496

memory/1964-0-0x0000000000400000-0x00000000005B7000-memory.dmp

Filesize
1.7MB

Download
memory/1964-1-0x0000000000400000-0x00000000005B7000-memory.dmp

Filesize
1.7MB

Download
memory/1964-2-0x0000000000400000-0x00000000005B7000-memory.dmp

Filesize
1.7MB

Download