6baa51da775f898b0cd03372be44ea4aa4355ac31c473d92f718b189c2e7b3f5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 09:38

Target

WallHack.dll
Size

160KB
MD5

bb2404176b6b87c415374b77ba385c8b
SHA1

5bfd694ce33c7003de417e1a9ad13bae3cfc229f
SHA256

8872a08ea3127543abc403dfeabfb6418936d61e1c9c10d328bd7c7f26fb0fb0
SHA512

0d48045b2a936d61c2d74db1a33f611533372943be57c00dc219a4f2ebd29e7e2e4a93181874b2a227d9b70d3d30c6ad05d22bd8ed4c3ff12f23ada4d154d644
SSDEEP

3072:IsS25sV8jvkKilsNhlquXJR3ve4cxL9jFkWUCKEl9/GKcGj:IsSm6KkhmDlBZULw53aoKj

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral3/memory/2204-0-0x0000000074D30000-0x0000000074D80000-memory.dmp	vmprotect
behavioral3/memory/2204-3-0x0000000074D30000-0x0000000074D80000-memory.dmp	vmprotect
behavioral3/memory/2204-4-0x0000000074D30000-0x0000000074D80000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2204	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WallHack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WallHack.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2204

memory/2204-0-0x0000000074D30000-0x0000000074D80000-memory.dmp

Filesize
320KB

Download
memory/2204-1-0x0000000074CE0000-0x0000000074D30000-memory.dmp

Filesize
320KB

Download
memory/2204-3-0x0000000074D30000-0x0000000074D80000-memory.dmp

Filesize
320KB

Download
memory/2204-4-0x0000000074D30000-0x0000000074D80000-memory.dmp

Filesize
320KB

Download
memory/2204-2-0x0000000074D20000-0x0000000074D70000-memory.dmp

Filesize
320KB

Download