4fbb73b577fc1c16c4a541e2deea88463be955ca2e89f9b39b9b8b3ac7169bed

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:21

Target
7f3bc7318488698291fae8a562424497.dll
Size 555KB
Sample240129-h6n3baebem
SHA256 4fbb73b577fc1c16c4a541e2deea88463be955ca2e89f9b39b9b8b3ac7169bed
MD5 7f3bc7318488698291fae8a562424497
SHA1 5f48e87c8a640f4b0ee34d3663f92d484e984ac2
SHA512 3dd14004553dbc52517e9a710e06d942f247161b9f61c4c8c68ef5b6c8b9cae9f2083ed262e4274ea0aaf79d10f84795409b15d086617758fd7dd4077c2c35eb
SSDEEP 12288:3tj/5PWI8mH11FAwInfM9yHeUK6z3UGMG7PbY8x:3V/5Pn8w1FAwInfS+UGM6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4604-0-0x0000000074EE0000-0x000000007500A000-memory.dmp	vmprotect
behavioral2/memory/4604-1-0x0000000074EE0000-0x000000007500A000-memory.dmp	vmprotect
behavioral2/memory/4604-3-0x0000000074EE0000-0x000000007500A000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4360	4604	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4604	1976	rundll32.exe	83
PID 1976 wrote to memory of 4604	1976	rundll32.exe	83
PID 1976 wrote to memory of 4604	1976	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f3bc7318488698291fae8a562424497.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f3bc7318488698291fae8a562424497.dll,#1
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 640
    3⤵
    - Program crash
    PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4604 -ip 4604
1⤵
PID:1988

memory/4604-0-0x0000000074EE0000-0x000000007500A000-memory.dmp

Download

memory/4604-1-0x0000000074EE0000-0x000000007500A000-memory.dmp

Download

memory/4604-3-0x0000000074EE0000-0x000000007500A000-memory.dmp

Download