4c3444fba14c364f4a1020ac2dd4b0d84f83b8c71ad45c38ca46cab1023d669e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/01/2024, 23:15

Target
v2009/data/MFC42.dll
Size 248KB
Sample240131-28yt3sgcdj
SHA256 823085ae318bef15d41ec27ffa59144ab320d40ddbdb8f9dbc2083d1b8cbcf26
MD5 e6a8231e861c6d024ad270f1100fb659
SHA1 a67d3aca8283a6917965beb471047093b598d3dc
SHA512 f28527f42aaab435f571117bf543fbb52938e32b791fd1c3adf6bba8777fddd57016bd48ff732fb29d3ec0cf482e388b1eb5ceb18ca890ccae95b9be46ee048d
SSDEEP 6144:p966ec6WLO2LnpUtfTwepMz5W9h7UAZ8:ac/LvjpOfI891Z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral3/memory/2780-0-0x0000000010000000-0x0000000010573000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2780	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2868 wrote to memory of 2780	2868	rundll32.exe	28
PID 2780 wrote to memory of 2088	2780	rundll32.exe	29
PID 2780 wrote to memory of 2088	2780	rundll32.exe	29
PID 2780 wrote to memory of 2088	2780	rundll32.exe	29
PID 2780 wrote to memory of 2088	2780	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v2009\data\MFC42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v2009\data\MFC42.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 228
    3⤵
    - Program crash
    PID:2088

memory/2780-0-0x0000000010000000-0x0000000010573000-memory.dmp

Download