Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2023, 14:44

General

  • Target

    Expensive.dll

  • Size

    6.3MB

  • MD5

    5808a4648b6412df885afc8ed89a5506

  • SHA1

    3e88eeedc30387658afa8313020b996f700f1b2f

  • SHA256

    94fe6dbe945913d47923ff31b16180997a9273de2e2cd6fd76e6b06e228fb5b3

  • SHA512

    6a38285a645577aacc2f32804c6a8e2b88f42eb495a8083c14d6bd422ccaa1a9e0bc8f4f715c2b8ec89354a4871239553f70c9794bf3b85a7535a8e636a51f15

  • SSDEEP

    98304:ltvX9ZVfebgQkI8V9ux8YMMV8fE6lRCx/kNM1LFQfbuMtW8OdcbDHv3uHxDkWjK5:T9Hfeb259EMdlRkcuobusW8LuCNpX

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Expensive.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2244

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2244-0-0x0000000076F80000-0x0000000076F82000-memory.dmp

          Filesize

          8KB

        • memory/2244-2-0x000007FEF43F0000-0x000007FEF50CD000-memory.dmp

          Filesize

          12.9MB

        • memory/2244-3-0x0000000076F80000-0x0000000076F82000-memory.dmp

          Filesize

          8KB

        • memory/2244-5-0x0000000076F80000-0x0000000076F82000-memory.dmp

          Filesize

          8KB

        • memory/2244-7-0x0000000076DD0000-0x0000000076F79000-memory.dmp

          Filesize

          1.7MB

        • memory/2244-11-0x0000000076DD0000-0x0000000076F79000-memory.dmp

          Filesize

          1.7MB