13f55fc3fa4fe85b072c9ef42b3033302ba039f4640109494c648e4df535cb02

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 19:33

Target

13f55fc3fa4fe85b072c9ef42b3033302ba039f4640109494c648e4df535cb02.dll
Size

950KB
MD5

b109724013c09a41bb7d22af770a70a7
SHA1

2980188cc26c34fbd0b1afac888abf66d42b2185
SHA256

13f55fc3fa4fe85b072c9ef42b3033302ba039f4640109494c648e4df535cb02
SHA512

4baf78a548378bfe4d10cd6c4164188702b9fe0d9f61e4503e425b8661ccbf607549be105b47481b9d482453dcde4e917bd1c35820b3e4ef93f2a2007c4724cb
SSDEEP

24576:a4YHVUTXDTxL8b5PxVe6XeZKERDypmiFBFqZ:eVMDicFEBkZ

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2740-0-0x00000000755D0000-0x0000000075801000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2740	3240	rundll32.exe	86
PID 3240 wrote to memory of 2740	3240	rundll32.exe	86
PID 3240 wrote to memory of 2740	3240	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13f55fc3fa4fe85b072c9ef42b3033302ba039f4640109494c648e4df535cb02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13f55fc3fa4fe85b072c9ef42b3033302ba039f4640109494c648e4df535cb02.dll,#1
  2⤵
  PID:2740

memory/2740-0-0x00000000755D0000-0x0000000075801000-memory.dmp

Filesize
2.2MB

Download