8dbf92538852415e7fa2fb125143662073c6c31356b11957e5b39b4077666bbc

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 19:00

Target
7b05ae8f410def372a6884b45fd3aa87.dll
Size 944KB
Sample240127-xn2ysaaaf2
SHA256 8dbf92538852415e7fa2fb125143662073c6c31356b11957e5b39b4077666bbc
MD5 7b05ae8f410def372a6884b45fd3aa87
SHA1 195439cb6e3011002f9a5671951c2af35587742c
SHA512 c92fabbe31e4c0fa8517015731baaf27063186a571910c4d92eb6e3f55816898a2f53365d0ba06f4d6bd392467297d84a10aa740bfcb4c12e627f0fc388b3c19
SSDEEP 24576:Z0drO5rvAhZJMgr+9hZ3XwuwIwoHhyijiQy:Z0d6xvA7JMe+9hZHwIJhyP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4520-0-0x0000000010000000-0x000000001023F000-memory.dmp	vmprotect
behavioral2/memory/4520-1-0x0000000010000000-0x000000001023F000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	rundll32.exe
4520	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4520	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4520	1224	rundll32.exe	87
PID 1224 wrote to memory of 4520	1224	rundll32.exe	87
PID 1224 wrote to memory of 4520	1224	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b05ae8f410def372a6884b45fd3aa87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b05ae8f410def372a6884b45fd3aa87.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4520

memory/4520-0-0x0000000010000000-0x000000001023F000-memory.dmp

Download

memory/4520-1-0x0000000010000000-0x000000001023F000-memory.dmp

Download