e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1741s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

Celery/dll/VMProtectSDK32.dll
Size

98KB
MD5

7ff7f1e0cc2bb5a6eac9c21762ee66b2
SHA1

8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5
SHA256

ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074
SHA512

f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9
SSDEEP

1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4904 wrote to memory of 3556	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 3556	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 3556	4904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\VMProtectSDK32.dll,#1
2⤵
PID:3556