Resubmissions
15/01/2023, 00:36
230115-aybg9abe6s 815/01/2023, 00:11
230115-agp93sfe58 815/01/2023, 00:06
230115-ad4y3abc3t 8Analysis
-
max time kernel
51s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15/01/2023, 00:11
Behavioral task
behavioral1
Sample
interium/crack/v4.dll
Resource
win10-20220812-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
interium/crack/v4.exe
Resource
win10-20220812-en
12 signatures
150 seconds
General
-
Target
interium/crack/v4.dll
-
Size
14.7MB
-
MD5
4b25ddde53db2c330ba626907a215567
-
SHA1
d9b91e07b7c865d665c1304bcb6c5f6c23e21458
-
SHA256
71030519768ec7c316add9d354df5d05c307218c459acf6b57f1d8cf3007f7aa
-
SHA512
f193bd0d6ecb0f27e3c37acfb64ab6a0658ad88d42b15655be6f42bf83b6aa202088acb9d4e590fb76263d88926f9b063bb25c1593b2bfcaa3018220a433aef7
-
SSDEEP
393216:jl7MsZ1LWvPSdVZ/QWjHc+p1y/cUpt+zBK9ub:jl7HEPS6WjppAEot+zBfb
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1692-178-0x0000000072480000-0x00000000742CC000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3764 wrote to memory of 1692 3764 rundll32.exe 66 PID 3764 wrote to memory of 1692 3764 rundll32.exe 66 PID 3764 wrote to memory of 1692 3764 rundll32.exe 66
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\interium\crack\v4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\interium\crack\v4.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692
-