f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 12:15

Target

f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll
Size

1.2MB
MD5

a41dc1d64d1aaa19a830aa50b94f1aae
SHA1

aa2c34958d402e6866c765f08ba7b5d4434662ee
SHA256

f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718
SHA512

c6858a4558dd14e2d93dffbf8207d03ddfc934522eb1160b25e0bdaa0595aa0ef639fbb2d0419473d435c23b929de1b6e2ef0a8068e48d63e31fa223071399f5
SSDEEP

24576:2Ts6Lw2QEkMUVUzWf0UTe96tMr4kAU8KWKpAaXNHtUgDBE+KoM:2ozZMNWfPRUJd3NUgDO+KoM

Score

7^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2368-0-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect
behavioral1/memory/2368-1-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect
behavioral1/memory/2368-2-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect
behavioral1/memory/2368-3-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2368

memory/2368-0-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download
memory/2368-1-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download
memory/2368-2-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download
memory/2368-3-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download