Analysis
-
max time kernel
39s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
29-11-2022 19:47
General
-
Target
c06951ac98e587108543cbf20046700efe80d257a5b34205622ad8bd2049adfc.dll
-
Size
3.7MB
-
MD5
4668d4fcd04969101d04962e32a704fe
-
SHA1
a5521b12c834b5c1f3bf9dd84799cb95d6c17a51
-
SHA256
c06951ac98e587108543cbf20046700efe80d257a5b34205622ad8bd2049adfc
-
SHA512
221ae63eac60bce41e179d1407b58a43c437803e5764a08379bd2f8b63df5ec367c3d91e1ea6f57fd0d9d85a7b64206dc229ac7efb58c4a3aa550aaee3d944ef
-
SSDEEP
49152:Ta1PGtlqJIU6irgk0FtF8Eing5BIxCoj0QUTIwEnVPPqpGx9Tlz:+W+8HIxCoj0QUTIwkcpGx
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c06951ac98e587108543cbf20046700efe80d257a5b34205622ad8bd2049adfc.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 884 -s 2962⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-57-0x0000000000000000-mapping.dmp
-
memory/884-55-0x0000000180000000-0x00000001803B7000-memory.dmpFilesize
3.7MB
-
memory/884-56-0x0000000180000000-0x00000001803B7000-memory.dmpFilesize
3.7MB
-
memory/884-58-0x0000000180000000-0x00000001803B7000-memory.dmpFilesize
3.7MB