0517d8760ae58871d042179fbd554c8cd9a99b625e5f800bc2ac3f8d8592eede

Analysis

max time kernel
35s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 19:52

Target

SolаrQ ソララ/dll/VMProtectSDK32.dll
Size

98KB
MD5

7ff7f1e0cc2bb5a6eac9c21762ee66b2
SHA1

8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5
SHA256

ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074
SHA512

f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9
SSDEEP

1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4520 5080 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4520	5080	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3452 wrote to memory of 5080	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 5080	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 5080	3452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SolаrQ ソララ\dll\VMProtectSDK32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SolаrQ ソララ\dll\VMProtectSDK32.dll",#1
2⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 600
3⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5080 -ip 5080
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
1⤵
PID:3956