Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 20:38
General
-
Target
c575776b81298467efd9a9f160cf8e7488b02be5a4f1431a8d72beb8dcc8eb51.dll
-
Size
2.1MB
-
MD5
73882d3f4448ff1605f06d20b1b14024
-
SHA1
4d3183b5d91cd22a66476e6ec4c0472c367b8254
-
SHA256
c575776b81298467efd9a9f160cf8e7488b02be5a4f1431a8d72beb8dcc8eb51
-
SHA512
9665adedb71a9e867ffa9c6709e1a25169152d63aa5c624fbced7bb16930812ccef8dfde5eb02e9a65f2daad281c2f040ecb8577facf8434c463b16d38e461f6
-
SSDEEP
24576:zvYW1jtpvrHPdDcVAu28I2IbYJzJQ0mSaiIxbTSaIZ9Cg7p9kBZv1qw1UykPJBo:cDV7uSai9pRkBZvg8UyGo
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c575776b81298467efd9a9f160cf8e7488b02be5a4f1431a8d72beb8dcc8eb51.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c575776b81298467efd9a9f160cf8e7488b02be5a4f1431a8d72beb8dcc8eb51.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB