b52da1ee04e42c4cdf4709ebf085ecdcfba723575b712a8671764fda01329289

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 16:47

Target
鼠标连点器/BBXTools/jianpan/tckpts.dll
Size 133KB
Sample240131-val93aghh4
SHA256 934766b218623fee06bdca31f6c7397c7fe40547d555f35f18c07850641cadb5
MD5 20460b534e8baa7eaffcf7d020993cfd
SHA1 c238f4d0cb1a126b774b186659da643560b5a9d9
SHA512 9d73c795df99f19680d2e810163afa16f0d25e983c6d07b55373ca3e56f55022cb92d5628a5fc67abe52eddb85be74782db8aa7f8cf5dae1e355eb77bac3a66b
SSDEEP 3072:/lWPT7WsSHFttCrUp5XgPddLy4IiRKdODMzWPVM8Vx:/IPePFmq5XgPddL9IihMqttx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral8/memory/4552-0-0x0000000000010000-0x0000000000037000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4552	2272	rundll32.exe	84
PID 2272 wrote to memory of 4552	2272	rundll32.exe	84
PID 2272 wrote to memory of 4552	2272	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\鼠标连点器\BBXTools\jianpan\tckpts.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\鼠标连点器\BBXTools\jianpan\tckpts.dll,#1
  2⤵
  PID:4552

memory/4552-0-0x0000000000010000-0x0000000000037000-memory.dmp

Download