e08d97713ab2cf5f4a9159b0454ecef679d7b2e4d83dd855678b7e701f0b820f

Analysis

max time kernel
92s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:29

Target

ubiorbitapi_r2.dll
Size

749KB
MD5

86ba92c8c93593d0dac364c8cad2346d
SHA1

9ad987aed677a595cb6cb507a12a014989d4e597
SHA256

79e6323661385f527d3774ec3abc002e402c4e2870ae0d6412c825c7d4556675
SHA512

543b5281bb0e2ffb0b9ad0d105ab00e2b9e1e4531edc658561bc5e9913cf1210ff6a4ae32da9468bfb2c7151b967a386062f9f96296f5afee818a33de5cf3c07
SSDEEP

12288:vNH+1gxr2WF9Bqx8lP2J01htFH/nydD0M9gRcCDtrZnw0Xu5ZGFaw:1H+16r2+9BNt2u1htFH/ny+fdxreku5M

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4720-0-0x00000000755B0000-0x000000007575E000-memory.dmp	vmprotect
behavioral2/memory/4720-1-0x00000000755B0000-0x000000007575E000-memory.dmp	vmprotect
behavioral2/memory/4720-5-0x00000000755B0000-0x000000007575E000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4720	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4720	3312	rundll32.exe	83
PID 3312 wrote to memory of 4720	3312	rundll32.exe	83
PID 3312 wrote to memory of 4720	3312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiorbitapi_r2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiorbitapi_r2.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4720

memory/4720-0-0x00000000755B0000-0x000000007575E000-memory.dmp

Filesize
1.7MB

Download
memory/4720-1-0x00000000755B0000-0x000000007575E000-memory.dmp

Filesize
1.7MB

Download
memory/4720-5-0x00000000755B0000-0x000000007575E000-memory.dmp

Filesize
1.7MB

Download