0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3 | Triage

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:18

Sharing

Report Analysis Logs

General

Target

明月11.79/Patch.dll
Size

625KB
MD5

b30b84fee780d18c50abb5362660afe8
SHA1

4abebd38e626e46fe733651ddcc5473e3963dc33
SHA256

0a8424c869d300140229b5beb056c6d17cd406b49301c4201a0d3107183b1a8d
SHA512

f4fba6721e7a427506602a98ca4fa329fb0dceef447d11a0ae838832d25a3e0aa7f22e3fd053f62898de2a7387cb4838a139b16dc3c23c960e5cd835ef8a5f64
SSDEEP

12288:lI6mIjEM4kLEXUekMDauTEgQk7nbEZqCS0bNgWIwNWfVPfo4OCu9MK:lIhpM4kLYwyawES7O3CwMfmQK

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral8/memory/4608-133-0x0000000075480000-0x00000000755C0000-memory.dmp	vmprotect
behavioral8/memory/4608-135-0x0000000075480000-0x00000000755C0000-memory.dmp	vmprotect
behavioral8/memory/4608-136-0x0000000075480000-0x00000000755C0000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4292 wrote to memory of 4608	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 4608	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 4608	4292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\Patch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\Patch.dll,#1
2⤵
PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4608-132-0x0000000000000000-mapping.dmp

Download
memory/4608-133-0x0000000075480000-0x00000000755C0000-memory.dmp

Filesize
1.2MB

Download
memory/4608-135-0x0000000075480000-0x00000000755C0000-memory.dmp

Filesize
1.2MB

Download
memory/4608-136-0x0000000075480000-0x00000000755C0000-memory.dmp

Filesize
1.2MB

Download