26ad20724d0e46debcaeb007d387e6308bafe28ab1f4472536a80c8068e7d421 | Triage

Analysis

max time kernel
77s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2022 01:31

Sharing

Report Analysis Logs

General

Target

03061448.dll
Size

2.1MB
MD5

369766ba654c9568e100299c5f77ffe9
SHA1

6e03f5bcdb9fde06bd02da20a348bca605c8f6cb
SHA256

26ad20724d0e46debcaeb007d387e6308bafe28ab1f4472536a80c8068e7d421
SHA512

5005590df0f776b646758589dd84b0ed44e7db8363563eddf0d09181d8892e3f671b69c2db1fc84b7bcb7f900bd848fc04bd3e1739593246083d5c099f01b674

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4704-131-0x0000000075440000-0x00000000758AE000-memory.dmp	vmprotect
behavioral2/memory/4704-132-0x0000000075440000-0x00000000758AE000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4748 wrote to memory of 4704	4748	rundll32.exe	rundll32.exe
PID 4748 wrote to memory of 4704	4748	rundll32.exe	rundll32.exe
PID 4748 wrote to memory of 4704	4748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03061448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03061448.dll,#1
2⤵
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-130-0x0000000000000000-mapping.dmp

Download
memory/4704-131-0x0000000075440000-0x00000000758AE000-memory.dmp

Filesize
4.4MB

Download
memory/4704-132-0x0000000075440000-0x00000000758AE000-memory.dmp

Filesize
4.4MB

Download