08e3fbb9a759bd559d4d46468b0a1d44fe9d8a2f6b82fa2807d42d1e642eb7c1 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 04:04

Sharing

Report Analysis Logs

General

Target

ECCfunctions.dll
Size

220KB
MD5

417d888272d2b4545f9914359a2427c7
SHA1

926fd808cda06bd9203d7fa5a0ec407790d45d61
SHA256

66b014fb1055d74dea53033f0d8a5a253b95262a1b39c56ef7f7dcf2df9e5fd4
SHA512

2b4c1484bc55d963a7315976862adc5299b176621019990c5b644005533315e605206958d9ee0759848081319e5dfc1b292e0c693433270d95adc4cdb0adfe0b
SSDEEP

6144:kpMXogngYG7EED8gJJgS7FKLsHNrjYLSILQ8lubj/g34A2:oMlUQCGkALs9eETzgIB

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral5/memory/1568-56-0x0000000010000000-0x0000000010081000-memory.dmp	vmprotect
behavioral5/memory/1568-59-0x0000000010000000-0x0000000010081000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1568	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 1568 wrote to memory of 1060	1568	rundll32.exe	28
PID 1568 wrote to memory of 1060	1568	rundll32.exe	28
PID 1568 wrote to memory of 1060	1568	rundll32.exe	28
PID 1568 wrote to memory of 1060	1568	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ECCfunctions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ECCfunctions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 228
    3⤵
    - Program crash
    PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1568-56-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/1568-59-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download