4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 16:41

Target

bin/MatSploit.dll
Size

6.9MB
MD5

569a4787d78d9265ce8e554866782dff
SHA1

2977bdf2ab1aaf1ca7d4fce317688704e4128d43
SHA256

8507d520156b39254eeef619c8319cf2bef874ed2ea0cd2f58ddbc9202183d25
SHA512

1fe9664798bcdc1d74392ab1fa86db25932cbac20c5e24f0c3291911c2569e88373222f9e7925c148ed234957aade020687a501f58189ab7a3d16eb77e7f1aed
SSDEEP

196608:Fv+Lg8T+IrHUnc62aksjpMpAgpmO4EfaYbT:Fv5E0lksNMuamU

Score

8^/10

vmprotect

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

27 1548 rundll32.exe

flow	pid	process
27	1548	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral16/memory/1548-135-0x0000000074820000-0x000000007558F000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1548 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1548 rundll32.exe
1548 rundll32.exe
1548 rundll32.exe
1548 rundll32.exe
1548 rundll32.exe
1548 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1548 rundll32.exe

pid	process
1548	rundll32.exe

pid	process
1548	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2700 wrote to memory of 1548	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 1548	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 1548	2700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MatSploit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MatSploit.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1548

memory/1548-133-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/1548-134-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1548-135-0x0000000074820000-0x000000007558F000-memory.dmp

Filesize
13.4MB

Download