797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8

Analysis

max time kernel
145s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 16:52

Target

miflash_unlock-en-6.5.224.28/VMProtectSDK32.dll
Size

106KB
MD5

13983d15ecc4e38ed7312efc9f485659
SHA1

6ecc19bdc359b046941fd902948dafa633340478
SHA256

ccdbf0c4b78a90f7351b7a4633f1106a41212cb7efb71cdf076c85d2faa81b00
SHA512

58f24af42bf5043835f3c1063f0a0a56cb3091f56355b1c058f24448a7136c0a12ddadcc67ceffe8daccfeba8562137c08436e33c94b6bd05107ed78ac717501
SSDEEP

1536:JT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwb0YXowGFh7e:7hQC2mCYK3RhrZ9dPk2Q9yMJwb0YRGfi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4536	3696	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3696	1528	rundll32.exe	80
PID 1528 wrote to memory of 3696	1528	rundll32.exe	80
PID 1528 wrote to memory of 3696	1528	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\VMProtectSDK32.dll,#1
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 408
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3696 -ip 3696
1⤵
PID:3388