6870bf8a46c295ed4a7afaf8d821bc157fab21fa2aff69c71175ab974a4a6878 | Triage

Analysis

max time kernel
161s
max time network
196s
platform
windows10_x64
resource
win10-en-20211208
submitted
28-01-2022 20:30

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

f5c9f86cde17352657ef69da4883f025
SHA1

30fa7995ebfc18d34f6091b5cecf2076243338c2
SHA256

17d2409a2646401f6652a4612d7ed3df8d654461c88b4412b9cf1c7462f65af8
SHA512

baadaa071263e21cc22e2362d619ab510bfb3edd916a282573f3d5cf7952bc1e7b3ee4210cb4d705f7a2d34eb59bbad15733f6d5ec74fa7414fab8927920653b

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4000-115-0x0000000004A90000-0x000000000700C000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4000	4188	rundll32.exe	69
PID 4188 wrote to memory of 4000	4188	rundll32.exe	69
PID 4188 wrote to memory of 4000	4188	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-115-0x0000000004A90000-0x000000000700C000-memory.dmp

Filesize
37.5MB

Download