Analysis
- max time kernel
141s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
22/12/2023, 12:29
General
- Target 8c145eb875f43b858165976bd3e556ab.dll
- Size 747KB
- Sample231222-pnwsrscch8
- SHA256 9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba
Score
7/10
Malware Config
Signatures
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#11⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1168-0-0x00000000023D0000-0x0000000002589000-memory.dmp
memory/1168-2-0x00000000023D0000-0x0000000002589000-memory.dmp
memory/1168-1-0x00000000023D0000-0x0000000002589000-memory.dmp
memory/1168-3-0x00000000023D0000-0x0000000002589000-memory.dmp