60ecd4c10573d9528a2d64f9b5adcce6d47080a820f8e134623f7ee0e8811db2

Analysis

max time kernel
90s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
06-05-2024 19:20

Target

Celery/dll/VMProtectSDK32.dll
Size

98KB
MD5

7ff7f1e0cc2bb5a6eac9c21762ee66b2
SHA1

8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5
SHA256

ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074
SHA512

f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9
SSDEEP

1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3380	2284	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2284	1448	rundll32.exe	80
PID 1448 wrote to memory of 2284	1448	rundll32.exe	80
PID 1448 wrote to memory of 2284	1448	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celery\dll\VMProtectSDK32.dll,#1
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 448
    3⤵
    - Program crash
    PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2284 -ip 2284
1⤵
PID:4196