4c3444fba14c364f4a1020ac2dd4b0d84f83b8c71ad45c38ca46cab1023d669e

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 23:15

Target
v2009/data/MFC42.dll
Size 248KB
Sample240131-28yt3sgcdj
SHA256 823085ae318bef15d41ec27ffa59144ab320d40ddbdb8f9dbc2083d1b8cbcf26
MD5 e6a8231e861c6d024ad270f1100fb659
SHA1 a67d3aca8283a6917965beb471047093b598d3dc
SHA512 f28527f42aaab435f571117bf543fbb52938e32b791fd1c3adf6bba8777fddd57016bd48ff732fb29d3ec0cf482e388b1eb5ceb18ca890ccae95b9be46ee048d
SSDEEP 6144:p966ec6WLO2LnpUtfTwepMz5W9h7UAZ8:ac/LvjpOfI891Z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral4/memory/3196-0-0x0000000010000000-0x0000000010573000-memory.dmp	vmprotect
behavioral4/memory/3196-1-0x0000000010000000-0x0000000010573000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3648	3196	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3196	4208	rundll32.exe	19
PID 4208 wrote to memory of 3196	4208	rundll32.exe	19
PID 4208 wrote to memory of 3196	4208	rundll32.exe	19

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v2009\data\MFC42.dll,#1
1⤵
PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 628
  2⤵
  - Program crash
  PID:3648

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v2009\data\MFC42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3196 -ip 3196
1⤵
PID:5000

memory/3196-0-0x0000000010000000-0x0000000010573000-memory.dmp

Download

memory/3196-1-0x0000000010000000-0x0000000010573000-memory.dmp

Download