4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
25s
max time network
28s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 16:41

Target

bin/MatSploit.dll
Size

6.9MB
MD5

569a4787d78d9265ce8e554866782dff
SHA1

2977bdf2ab1aaf1ca7d4fce317688704e4128d43
SHA256

8507d520156b39254eeef619c8319cf2bef874ed2ea0cd2f58ddbc9202183d25
SHA512

1fe9664798bcdc1d74392ab1fa86db25932cbac20c5e24f0c3291911c2569e88373222f9e7925c148ed234957aade020687a501f58189ab7a3d16eb77e7f1aed
SSDEEP

196608:Fv+Lg8T+IrHUnc62aksjpMpAgpmO4EfaYbT:Fv5E0lksNMuamU

Score

8^/10

vmprotect

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1952 rundll32.exe

flow	pid	process
2	1952	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral15/memory/1952-60-0x0000000072800000-0x000000007356F000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1952 rundll32.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rundll32.exe

pid process

1952 rundll32.exe
1952 rundll32.exe
1952 rundll32.exe

pid	process
1952	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1952	1556	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MatSploit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

memory/1952-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-54-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-56-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-57-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-58-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-59-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-60-0x0000000072800000-0x000000007356F000-memory.dmp

Filesize
13.4MB

Download
memory/1952-63-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download