4e459e942437ee7a6b767925f7cfaac795f9049c71b9211392061b2f4338dbfb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 16:52

Target

VMProtectSDK32.dll
Size

62KB
MD5

1e6fdcd6d847bbf9cd3a37ba72cda3f7
SHA1

4630e17975f151858f6acefb591286d09daaf6f9
SHA256

06754cb39c2e814577ac287b7dd0083f59933c867038407cddfb22ebc6c0f193
SHA512

1ff53ac4eff9a2eb33f9e3f51dc848154d19e36cfc6e02912fde6e4004bfbfada3fa7ad76079ec18026ab7305f603f11e647682cb410efba1f27f7e9fd2be0f1
SSDEEP

768:HoPxJEvm79UXEHoJ9Zu+mCpvuJx/cH/3raj5ckespr6vv6USYhCDgAkhHHqD+x8:HoP7EvctUT3Gejaj5He66KUScM+x8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtectSDK32.dll,#1
2⤵
PID:1652