e4befe0ff3a0ab597382b7a29b149c53b39d3963739fb568a3507100628a7318

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:00

Target

e4befe0ff3a0ab597382b7a29b149c53b39d3963739fb568a3507100628a7318.dll
Size

846KB
MD5

e9379b937e595400eed7fa0af6e00ccc
SHA1

97f9b87ec150b24b5b5e90ec154ee684151746cf
SHA256

e4befe0ff3a0ab597382b7a29b149c53b39d3963739fb568a3507100628a7318
SHA512

63521522a14bcf0ed1954e1ffb94d3bf09924f6622e9e87de04836c76adbdd772a04f5356154d724446586adf41b0fe9273c64aabec4339bb7a7277e4e805737
SSDEEP

24576:yR7Y9QwqjYGawx71BSOKcOfDqBM30SRtx:ydY9RwYbw5lLNM3

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/220-1-0x0000000075440000-0x0000000075604000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 220	4688	rundll32.exe	82
PID 4688 wrote to memory of 220	4688	rundll32.exe	82
PID 4688 wrote to memory of 220	4688	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4befe0ff3a0ab597382b7a29b149c53b39d3963739fb568a3507100628a7318.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4befe0ff3a0ab597382b7a29b149c53b39d3963739fb568a3507100628a7318.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:220

memory/220-1-0x0000000075440000-0x0000000075604000-memory.dmp

Filesize
1.8MB

Download