8a9de744f3f85a82ef8247c5f21be9e4e7c8ebdaed706a9adafa55ab62059f80

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 10:42

Target

Pain Exist 3.9/PainModule.dll
Size

6.8MB
MD5

61db7ecdc707673f5797425d3e936870
SHA1

802da01ef03a4aa806db3f7c0f9ff960fc5424e5
SHA256

2ce31c255dfc3a5bc85f03c2eed482e3824d283f53e8e4ad1d31be8fe32dc2cb
SHA512

d9af56acc2e3408194e3331fde24f88848453ed0d13a442bd873f31246ceab538bdcbbd9aeb4e948c2ea9512dd7f303f0674c2535afcbfff9e737b1d48445683
SSDEEP

196608:ZiJHJtypF7mBSWcZuAkWwvavP1R0UB5MSr:cV7yn7mUQAkavP1CUB5MSr

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral12/memory/1004-1-0x0000000073CF0000-0x00000000749A1000-memory.dmp	vmprotect
behavioral12/memory/1004-5-0x0000000073CF0000-0x00000000749A1000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exe

pid process

1004 rundll32.exe
1004 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4116 1004 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1004 rundll32.exe
1004 rundll32.exe
1004 rundll32.exe
1004 rundll32.exe

pid	process
1004	rundll32.exe
1004	rundll32.exe

pid	pid_target	process	target process
4116	1004	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3112 wrote to memory of 1004	3112	rundll32.exe	rundll32.exe
PID 3112 wrote to memory of 1004	3112	rundll32.exe	rundll32.exe
PID 3112 wrote to memory of 1004	3112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Pain Exist 3.9\PainModule.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 892
3⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1004 -ip 1004
1⤵
PID:3064

memory/1004-0-0x0000000073E1F000-0x0000000074314000-memory.dmp

Filesize
5.0MB

Download
memory/1004-1-0x0000000073CF0000-0x00000000749A1000-memory.dmp

Filesize
12.7MB

Download
memory/1004-3-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1004-2-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1004-5-0x0000000073CF0000-0x00000000749A1000-memory.dmp

Filesize
12.7MB

Download
memory/1004-8-0x0000000073E1F000-0x0000000074314000-memory.dmp

Filesize
5.0MB

Download
memory/1004-7-0x0000000073CF0000-0x00000000749A1000-memory.dmp

Filesize
12.7MB

Download