9cffc88ae58bd23feee4df751c30b340e84838a638d4413b044c76d07ae7e2da | Triage

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 08:58

Sharing

Report Analysis Logs

General

Target

CloudSDK.dll
Size

6.4MB
MD5

4f973bf01fe12baadf82886b26110cc1
SHA1

0516016c8d8092f720c2415f550c9ed17edbb5b9
SHA256

9cffc88ae58bd23feee4df751c30b340e84838a638d4413b044c76d07ae7e2da
SHA512

2bc88715ca303dd508283b255b7f5bf7ae4a4c32cf92c6d80ecf63d6d95e735839958e1c0441e91cd5dfeb06c192065f5113faee1a3ac9f7d1a2e8bbc6aa0fa5
SSDEEP

196608:VWqIz4vW8jMRutHZkAX7/tH4wAIY9YK5VT:wqEqMRAZBAr20

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1772-134-0x00000000745B0000-0x000000007505E000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	1772	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	rundll32.exe
1772	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1772	3892	rundll32.exe	81
PID 3892 wrote to memory of 1772	3892	rundll32.exe	81
PID 3892 wrote to memory of 1772	3892	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudSDK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudSDK.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 604
    3⤵
    - Program crash
    PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1772 -ip 1772
1⤵
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-133-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/1772-134-0x00000000745B0000-0x000000007505E000-memory.dmp

Filesize
10.7MB

Download