7fdabf9f07c56c725a34c3c1ca0f8ff0776360d1b45ff571a6afdb65f2acdedd

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 08:54

Target
531426ce9f21f54a6e25a3d4c1ffb56d.dll
Size 39KB
Sample240111-kt1lpachap
SHA256 7fdabf9f07c56c725a34c3c1ca0f8ff0776360d1b45ff571a6afdb65f2acdedd
MD5 531426ce9f21f54a6e25a3d4c1ffb56d
SHA1 67fcf65d111d44505b7ac10f3c8195cf67e4bddc
SHA512 9f9590b96b8f7faaa8c02dbbd5a6289553f9143568bc4ed20f1d70ac28fa60de43ff0b9619b6b780e5b26fcbf5d7d838433ee12772928e7942fbdb5a4ef860d0
SSDEEP 768:6DAc8m8xheoSJ4HFZDkqm4Kt7AU5/9iYIGPvDhsmchOb18hkvw/KA:GgIrJQFNLm4R49CGP7hsmHuh4w/n
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4596-0-0x0000000010000000-0x0000000010022000-memory.dmp	vmprotect
behavioral2/memory/4596-2-0x0000000010000000-0x0000000010022000-memory.dmp	vmprotect
behavioral2/memory/4596-3-0x0000000010000000-0x0000000010022000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	4596	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4596	3440	rundll32.exe	88
PID 3440 wrote to memory of 4596	3440	rundll32.exe	88
PID 3440 wrote to memory of 4596	3440	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\531426ce9f21f54a6e25a3d4c1ffb56d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\531426ce9f21f54a6e25a3d4c1ffb56d.dll,#1
  2⤵
  PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 660
    3⤵
    - Program crash
    PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4596 -ip 4596
1⤵
PID:2188

memory/4596-0-0x0000000010000000-0x0000000010022000-memory.dmp

Download

memory/4596-2-0x0000000010000000-0x0000000010022000-memory.dmp

Download

memory/4596-1-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/4596-3-0x0000000010000000-0x0000000010022000-memory.dmp

Download