27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17 | Triage

Analysis

max time kernel
147s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Sharing

Report Analysis Logs

General

Target

冰封免费版(请关闭杀毒软件下载)/3km2.dll
Size

1.5MB
MD5

2e5ff9dc7ea781a0d99895d318af3cef
SHA1

c2dddda1b2141a8d8fe2bd4619caffa4056e0737
SHA256

6d884320514ec3a9dbb66914eebbe03e66dd3623f124988d350dc6322b76098a
SHA512

fa0eccd58a8b7dbf8681547bc344d622391219fae1fa20eed3d7d67efa494e7f23c8670ad663ec35e4e1bb533c5ab7c784b195c5e96f7c954c45b7b2bbd50276
SSDEEP

49152:zJ58ZHuvPUbFLfdwDclKIM3IMhWaz0I0:D8ZHuvPUtQclPM3IMhWaj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4712-134-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect
behavioral2/memory/4712-135-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect
behavioral2/memory/4712-136-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

4712 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4712 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4752 wrote to memory of 4712	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 4712	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 4712	4752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\3km2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\3km2.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-133-0x0000000000000000-mapping.dmp

Download
memory/4712-134-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/4712-135-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/4712-136-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download