f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718

Analysis

max time kernel
138s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 12:15

Target

f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll
Size

1.2MB
MD5

a41dc1d64d1aaa19a830aa50b94f1aae
SHA1

aa2c34958d402e6866c765f08ba7b5d4434662ee
SHA256

f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718
SHA512

c6858a4558dd14e2d93dffbf8207d03ddfc934522eb1160b25e0bdaa0595aa0ef639fbb2d0419473d435c23b929de1b6e2ef0a8068e48d63e31fa223071399f5
SSDEEP

24576:2Ts6Lw2QEkMUVUzWf0UTe96tMr4kAU8KWKpAaXNHtUgDBE+KoM:2ozZMNWfPRUJd3NUgDO+KoM

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4940-0-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect
behavioral2/memory/4940-2-0x0000000010000000-0x0000000010321000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4940	5080	rundll32.exe	84
PID 5080 wrote to memory of 4940	5080	rundll32.exe	84
PID 5080 wrote to memory of 4940	5080	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e7fd0a724d272ac9e7bd0b6f60102bfe37e51db84a49fcbe2d6a2387d4a718.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4940

memory/4940-0-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download
memory/4940-2-0x0000000010000000-0x0000000010321000-memory.dmp

Filesize
3.1MB

Download