dbe37e52c1300f1ff21ff8b9fc65358af0f136a077cf8c1e5322d00df90ffb8b

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 14:32

Target

727caee9c6ec073e7ee80797b24c5e58.dll
Size

82KB
MD5

727caee9c6ec073e7ee80797b24c5e58
SHA1

8a426e07edb307cd27ee7cf422f82f33fc6e5f00
SHA256

dbe37e52c1300f1ff21ff8b9fc65358af0f136a077cf8c1e5322d00df90ffb8b
SHA512

f0a4ea223ad75a34502590098095bac5a1c1ceba0312f072e0f917f31b2810e58a74710aef3a3ee42359b220eed2806049a97f09e5db73352135814e1412cffc
SSDEEP

1536:kN0KCEeNFa4oZBAe0FnToIf+AwH92cbUfKBVjbkH+STD:kmKCEZBAe0tTBf+AwMcbX/jbkH7T

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3368-0-0x0000000010000000-0x0000000010019000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3368	2232	rundll32.exe	85
PID 2232 wrote to memory of 3368	2232	rundll32.exe	85
PID 2232 wrote to memory of 3368	2232	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\727caee9c6ec073e7ee80797b24c5e58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\727caee9c6ec073e7ee80797b24c5e58.dll,#1
  2⤵
  PID:3368

memory/3368-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download