b03046ca26ca55810e8ac7a7b753e81cc4e318afedbf4f42367e2cac74812461

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 19:50

Target
92d9bbf2095eb2e766fb00e3f5e56863.dll
Size 812KB
Sample240205-ykppqafcd2
SHA256 b03046ca26ca55810e8ac7a7b753e81cc4e318afedbf4f42367e2cac74812461
MD5 92d9bbf2095eb2e766fb00e3f5e56863
SHA1 bd951cb4c14ce1daa93e9b6c1cecd234231b400a
SHA512 c58b06665fd5436cdb2d9dcbb8bb7ee0525c6b31b25397694ec17d4c44d572c735c3bd761cb2a875f8950d79a45a216c299ee7d1b3944577a6bf9b53da1abbd9
SSDEEP 12288:435uNADfzsuiF4slEIEfsX9fwF7NJcCh+uCb3VJh3O42kVbWhzhuWyjUarvAMEO8:Uu+LsbpRE+oF7jzKzR35bWFhuWraEM98
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3000-0-0x0000000010000000-0x0000000010210000-memory.dmp	vmprotect
behavioral2/memory/3000-1-0x0000000010000000-0x0000000010210000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	rundll32.exe
3000	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3000	rundll32.exe
Token: SeIncBasePriorityPrivilege	3000	rundll32.exe
Token: SeDebugPrivilege	3000	rundll32.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3000	5016	rundll32.exe	83
PID 5016 wrote to memory of 3000	5016	rundll32.exe	83
PID 5016 wrote to memory of 3000	5016	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d9bbf2095eb2e766fb00e3f5e56863.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d9bbf2095eb2e766fb00e3f5e56863.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3000

memory/3000-0-0x0000000010000000-0x0000000010210000-memory.dmp

Download

memory/3000-1-0x0000000010000000-0x0000000010210000-memory.dmp

Download