00c8dd2a5e3c4dc0de3d339ab9ea329da84d1ec3eb1fff1bdb3b4822849cd652

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:18

Target
SecuriteInfo.com.Win32.Malware.5758.7337.dll
Size 5.1MB
Sample231219-mbyeqahdbl
SHA256 00c8dd2a5e3c4dc0de3d339ab9ea329da84d1ec3eb1fff1bdb3b4822849cd652
MD5 a1736f1cc560cb5d0837d5d65e8bc778
SHA1 9f93f5655c34a92ab28f5301e6117cd16fec45da
SHA512 84bb0a8b1fec4528b0e7fc3c64625e2c2941e0542b1184570ff826798c16ba34f258ba8665778ae795e5f2f34c7502a23cb82202344566272b2ffb7b090b9f2e
SSDEEP 49152:75IztkFyczouk1JUVbCZhtv7a+4pycXMDaUfFXjshOR/eSyC:75Ctk6abmtvOS+zhIe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1376-0-0x0000000010000000-0x0000000010032000-memory.dmp	vmprotect
behavioral2/memory/1376-1-0x0000000010000000-0x0000000010032000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	1376	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	rundll32.exe
1376	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1376	2128	rundll32.exe	90
PID 2128 wrote to memory of 1376	2128	rundll32.exe	90
PID 2128 wrote to memory of 1376	2128	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware.5758.7337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware.5758.7337.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 600
    3⤵
    - Program crash
    PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1376 -ip 1376
1⤵
PID:3984

memory/1376-0-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1376-1-0x0000000010000000-0x0000000010032000-memory.dmp

Download