6721e4c63bda51d9c4d9f35aca6c4abe0be8053bd399778b9de843bbd45a5c69 | Triage

Analysis

max time kernel
15s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 06:32

Sharing

Report Analysis Logs

General

Target

Mensagem.dll
Size

644KB
MD5

fadca7e86729e7ce5a48304ef3f64661
SHA1

59ecea636253e83398c9fc15d196155434a0de89
SHA256

0407a56e94aa86ed0d25bdacff90403cdee81605d7489cd10de5e37e137ec6cf
SHA512

19bb2e38b8e2145b0ba17e90f303bab4d97ace57b9ad0fe340d40a76b21847ea4c879c7692a6f37041e181224f261021f6a0262b0d935c1411c1ade696fd7160
SSDEEP

12288:V0uU2SDH0xFuc79cMUp1BaO2lnG59yxnSUsL4vzp2JkkccKa9dW+ht:V0uU2SjgFr78WO24KxS1st2Rxht

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/384-56-0x0000000000B90000-0x0000000000CF3000-memory.dmp	vmprotect
behavioral1/memory/384-58-0x0000000000B90000-0x0000000000CF3000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mensagem.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mensagem.dll,#1
2⤵
PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-54-0x0000000000000000-mapping.dmp

Download
memory/384-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/384-56-0x0000000000B90000-0x0000000000CF3000-memory.dmp

Filesize
1.4MB

Download
memory/384-58-0x0000000000B90000-0x0000000000CF3000-memory.dmp

Filesize
1.4MB

Download