9358d6ec43bbb528be937788669a284036e4cdbb37432b1f5ae9c80090a7118e

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:10

Target
7a3594c674104c06086220fc6fddf214.dll
Size 812KB
Sample240127-pb32babha2
SHA256 9358d6ec43bbb528be937788669a284036e4cdbb37432b1f5ae9c80090a7118e
MD5 7a3594c674104c06086220fc6fddf214
SHA1 d1ebe6f4107d922e6bb0819c0e04330505e9a04c
SHA512 b7e1d07ab75c036b6373db1decf7127e07b08d356b69c36e93965180f1e0ee43b38ea817d18482208488c0ca9f856562b4daf67382c2c7274623363ba9cbac3c
SSDEEP 24576:UCTO9aNRdZvuvSjHWZHtB7klFgBf+a41:UiHTdthj2ZNBAliF+a4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1808-0-0x0000000010000000-0x0000000010213000-memory.dmp	vmprotect
behavioral2/memory/1808-1-0x0000000010000000-0x0000000010213000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1808	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1808	1504	rundll32.exe	87
PID 1504 wrote to memory of 1808	1504	rundll32.exe	87
PID 1504 wrote to memory of 1808	1504	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a3594c674104c06086220fc6fddf214.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a3594c674104c06086220fc6fddf214.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1808

memory/1808-0-0x0000000010000000-0x0000000010213000-memory.dmp

Download

memory/1808-1-0x0000000010000000-0x0000000010213000-memory.dmp

Download