4f7ee2f0b15e8c78849483a2a14bca4037c5b67e3f0759bb687b6af7b148fb5f | Triage

Analysis

max time kernel
70s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 23:02

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

11ebde98977096e8eb8c62c55fb716d0
SHA1

7f1e39aeac561703737615e99ef1b6d3aa082bdd
SHA256

91e8b257c5403fa292f6e9e85591a7ffb642182cd7350c0087dce4b473732b1f
SHA512

cc288e9564e71bd0ca70256a7fc3340b8834270edb800ab2af82eee678d60cb957aa4711c40d92fbb2df6716ef06b2a109047adbb0c16992c01a775b42b316d5

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1440-131-0x0000000002830000-0x0000000004DA5000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1440	3872	rundll32.exe	77
PID 3872 wrote to memory of 1440	3872	rundll32.exe	77
PID 3872 wrote to memory of 1440	3872	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-131-0x0000000002830000-0x0000000004DA5000-memory.dmp

Filesize
37.5MB

Download