661608679626718991f31950e7d8f3040bc521f53ae943f2d26538e10f2d7dad

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 10:01

Target
79f2e37abc5770ad5a085beacc5bd5e3.dll
Size 143KB
Sample240127-l2ql5abfbq
SHA256 661608679626718991f31950e7d8f3040bc521f53ae943f2d26538e10f2d7dad
MD5 79f2e37abc5770ad5a085beacc5bd5e3
SHA1 a17a5e695e9d55d18422924c2547e2358934626b
SHA512 40335b332431c973e37b7c05d9c84f87e4ebd5c20eeb5c1abfbeedf891d74e964b58061bf0f4736991cce2cad1297ff0690f10b7450b6a5cf5c0557dac6db509
SSDEEP 3072:Kflo4t3e86BJ7jfJRJhDgWs+du7hc4GyaXIqXBkr7eO5:Kf+f8EnRf6WsouqEAvxkr5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3104-0-0x0000000010000000-0x0000000010024000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3104	2184	rundll32.exe	85
PID 2184 wrote to memory of 3104	2184	rundll32.exe	85
PID 2184 wrote to memory of 3104	2184	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79f2e37abc5770ad5a085beacc5bd5e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79f2e37abc5770ad5a085beacc5bd5e3.dll,#1
  2⤵
  PID:3104

memory/3104-0-0x0000000010000000-0x0000000010024000-memory.dmp

Download