4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
25s
max time network
28s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/03/2023, 16:41

Target

bin/MatSploit.dll
Size

6.9MB
MD5

569a4787d78d9265ce8e554866782dff
SHA1

2977bdf2ab1aaf1ca7d4fce317688704e4128d43
SHA256

8507d520156b39254eeef619c8319cf2bef874ed2ea0cd2f58ddbc9202183d25
SHA512

1fe9664798bcdc1d74392ab1fa86db25932cbac20c5e24f0c3291911c2569e88373222f9e7925c148ed234957aade020687a501f58189ab7a3d16eb77e7f1aed
SSDEEP

196608:Fv+Lg8T+IrHUnc62aksjpMpAgpmO4EfaYbT:Fv5E0lksNMuamU

Score

8^/10

vmprotect

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1952	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral15/memory/1952-60-0x0000000072800000-0x000000007356F000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1952	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28
PID 1556 wrote to memory of 1952	1556	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MatSploit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MatSploit.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

memory/1952-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-54-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-56-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1952-57-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-58-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-59-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1952-60-0x0000000072800000-0x000000007356F000-memory.dmp

Filesize
13.4MB

Download
memory/1952-63-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download