e69b344324e3583c3bb0c92a130d2c116eea9a3804ad17e4437dea3c2c4121cd | Triage

Analysis

max time kernel
22s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 04:56

Sharing

Report Analysis Logs

General

Target

hid.dll
Size

120KB
MD5

ddeaf23ab4dbcdff71ba3a8c47ac6280
SHA1

d71a2ce327c07e3e2f742d0b57ae4429d49c29e9
SHA256

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de
SHA512

badd59ea50299bb058d99d5a3b20ee08dadf3860592f05ae5744eec8e56164a911ecad3510cd68fa02dae64363b8e5a87b11d929a6793d115e0bfef45cd5daa8
SSDEEP

3072:U8br6KLnXnCUasJvM+mxxWXEoI5QX7c8f8M0BMiOCNn:9VLXnCkpGx6Ex67cT4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2000-56-0x0000000068BE0000-0x0000000068C1F000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hid.dll,#1
2⤵
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000000000000-mapping.dmp

Download
memory/2000-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000068BE0000-0x0000000068C1F000-memory.dmp

Filesize
252KB

Download