0517d8760ae58871d042179fbd554c8cd9a99b625e5f800bc2ac3f8d8592eede

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 19:52

Target

SolаrQ ソララ/dll/VMProtectSDK32.dll
Size

98KB
MD5

7ff7f1e0cc2bb5a6eac9c21762ee66b2
SHA1

8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5
SHA256

ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074
SHA512

f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9
SSDEEP

1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2912	2140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SolаrQ ソララ\dll\VMProtectSDK32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SolаrQ ソララ\dll\VMProtectSDK32.dll",#1
  2⤵
  PID:2912