8a9de744f3f85a82ef8247c5f21be9e4e7c8ebdaed706a9adafa55ab62059f80

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 10:42

Target

Pain Exist 3.9/PainModule.dll
Size

6.8MB
MD5

61db7ecdc707673f5797425d3e936870
SHA1

802da01ef03a4aa806db3f7c0f9ff960fc5424e5
SHA256

2ce31c255dfc3a5bc85f03c2eed482e3824d283f53e8e4ad1d31be8fe32dc2cb
SHA512

d9af56acc2e3408194e3331fde24f88848453ed0d13a442bd873f31246ceab538bdcbbd9aeb4e948c2ea9512dd7f303f0674c2535afcbfff9e737b1d48445683
SSDEEP

196608:ZiJHJtypF7mBSWcZuAkWwvavP1R0UB5MSr:cV7yn7mUQAkavP1CUB5MSr

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral11/memory/2960-1-0x0000000072EE0000-0x0000000073B91000-memory.dmp	vmprotect
behavioral11/memory/2960-12-0x0000000072EE0000-0x0000000073B91000-memory.dmp	vmprotect
behavioral11/memory/2960-15-0x0000000072EE0000-0x0000000073B91000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exe

pid process

2960 rundll32.exe
2960 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 2960 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2960 rundll32.exe
2960 rundll32.exe

pid	process
2960	rundll32.exe
2960	rundll32.exe

pid	pid_target	process	target process
2968	2960	WerFault.exe	rundll32.exe

pid	process
2960	rundll32.exe
2960	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2960	1776	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2968	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2968	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2968	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2968	2960	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Pain Exist 3.9\PainModule.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 320
3⤵
- Program crash
PID:2968

memory/2960-0-0x000000007300F000-0x0000000073504000-memory.dmp

Filesize
5.0MB

Download
memory/2960-1-0x0000000072EE0000-0x0000000073B91000-memory.dmp

Filesize
12.7MB

Download
memory/2960-2-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2960-4-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2960-11-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2960-12-0x0000000072EE0000-0x0000000073B91000-memory.dmp

Filesize
12.7MB

Download
memory/2960-9-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2960-15-0x0000000072EE0000-0x0000000073B91000-memory.dmp

Filesize
12.7MB

Download
memory/2960-7-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2960-16-0x0000000072EE0000-0x0000000073B91000-memory.dmp

Filesize
12.7MB

Download
memory/2960-18-0x000000007300F000-0x0000000073504000-memory.dmp

Filesize
5.0MB

Download