536b511c03ec1cffd11050e70f667e9eb29e8f689c1eda501282648abb5a3765

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:38

Target
2db3b2977d58fda79afe671c5b847862.dll
Size 114KB
Sample231231-jgqqaacac2
SHA256 536b511c03ec1cffd11050e70f667e9eb29e8f689c1eda501282648abb5a3765
MD5 2db3b2977d58fda79afe671c5b847862
SHA1 c7056611e6f827ccfb73455575ab5d94aea7ae0a
SHA512 13ec8071b930149dfce572d6965f4ceed240437bd074dd082b74c446398e4504f4e12c5ad39205e53b6e41b35d6d32e11adc44f9921f0517dc336827864c1c88
SSDEEP 3072:D29bdJAhl5IObIxb+BHMzVQenAqlAo8LxQsVjk:DkTAJMxb2HM+Rqv8LxQslk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3988-0-0x00000000007A0000-0x00000000007E8000-memory.dmp	vmprotect
behavioral2/memory/3988-1-0x00000000007A0000-0x00000000007E8000-memory.dmp	vmprotect
behavioral2/memory/3988-2-0x00000000007A0000-0x00000000007E8000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4784	3988	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3988	5004	rundll32.exe	88
PID 5004 wrote to memory of 3988	5004	rundll32.exe	88
PID 5004 wrote to memory of 3988	5004	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db3b2977d58fda79afe671c5b847862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db3b2977d58fda79afe671c5b847862.dll,#1
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 864
    3⤵
    - Program crash
    PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3988 -ip 3988
1⤵
PID:2952

memory/3988-0-0x00000000007A0000-0x00000000007E8000-memory.dmp

Download

memory/3988-1-0x00000000007A0000-0x00000000007E8000-memory.dmp

Download

memory/3988-2-0x00000000007A0000-0x00000000007E8000-memory.dmp

Download