81c77588ff1025e18341530946d2a6a7680708096fb146890175f0f072807afe

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 07:38

Target

7c889ee5d0a6f631d7287aae60a23ee7.dll
Size

743KB
MD5

7c889ee5d0a6f631d7287aae60a23ee7
SHA1

1dec0a470ec3fa24c39dcf08fe08fe894d080872
SHA256

81c77588ff1025e18341530946d2a6a7680708096fb146890175f0f072807afe
SHA512

b0ff6be237cce0a72b741a2260bdb0ce93f50d525c6650195f0c81199dc938b57aab080926bfd46b799e71c187312315f8014068b6b6342d6774117bb175a502
SSDEEP

12288:9375G4ZmrZKEfv0ACL8UhDLMNubns/YwDhyLTukPGhuzapNiB2twIdks/QI:95G4gff1CL8UMNeGjwTu0IJZiIdRoI

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1548-0-0x0000000002250000-0x0000000002408000-memory.dmp	vmprotect
behavioral1/memory/1548-2-0x0000000002250000-0x0000000002408000-memory.dmp	vmprotect
behavioral1/memory/1548-1-0x0000000002250000-0x0000000002408000-memory.dmp	vmprotect
behavioral1/memory/1548-3-0x0000000002250000-0x0000000002408000-memory.dmp	vmprotect
behavioral1/memory/1548-4-0x0000000002250000-0x0000000002408000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c889ee5d0a6f631d7287aae60a23ee7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c889ee5d0a6f631d7287aae60a23ee7.dll,#1
  2⤵
  PID:1548

memory/1548-0-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/1548-2-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/1548-1-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/1548-3-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/1548-4-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download