e08d97713ab2cf5f4a9159b0454ecef679d7b2e4d83dd855678b7e701f0b820f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:29

Target

ubiorbitapi_r2.dll
Size

749KB
MD5

86ba92c8c93593d0dac364c8cad2346d
SHA1

9ad987aed677a595cb6cb507a12a014989d4e597
SHA256

79e6323661385f527d3774ec3abc002e402c4e2870ae0d6412c825c7d4556675
SHA512

543b5281bb0e2ffb0b9ad0d105ab00e2b9e1e4531edc658561bc5e9913cf1210ff6a4ae32da9468bfb2c7151b967a386062f9f96296f5afee818a33de5cf3c07
SSDEEP

12288:vNH+1gxr2WF9Bqx8lP2J01htFH/nydD0M9gRcCDtrZnw0Xu5ZGFaw:1H+16r2+9BNt2u1htFH/ny+fdxreku5M

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2280-3-0x0000000074DE0000-0x0000000074F8E000-memory.dmp	vmprotect
behavioral1/memory/2280-8-0x0000000074DE0000-0x0000000074F8E000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2280	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28
PID 2196 wrote to memory of 2280	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiorbitapi_r2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiorbitapi_r2.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2280

memory/2280-0-0x0000000074F70000-0x000000007511E000-memory.dmp

Filesize
1.7MB

Download
memory/2280-1-0x0000000074DC0000-0x0000000074F6E000-memory.dmp

Filesize
1.7MB

Download
memory/2280-3-0x0000000074DE0000-0x0000000074F8E000-memory.dmp

Filesize
1.7MB

Download
memory/2280-7-0x0000000074F70000-0x000000007511E000-memory.dmp

Filesize
1.7MB

Download
memory/2280-8-0x0000000074DE0000-0x0000000074F8E000-memory.dmp

Filesize
1.7MB

Download