Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
24/12/2023, 03:47
General
- Target 179c5ec9b7d17e3beed96c26b42b9e2a1f03fc8ad4cf3f799b52582159e09bb8.dll
- Size 7.8MB
- Sample231224-ecd4gaehej
- SHA256 179c5ec9b7d17e3beed96c26b42b9e2a1f03fc8ad4cf3f799b52582159e09bb8
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\179c5ec9b7d17e3beed96c26b42b9e2a1f03fc8ad4cf3f799b52582159e09bb8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\179c5ec9b7d17e3beed96c26b42b9e2a1f03fc8ad4cf3f799b52582159e09bb8.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1848-0-0x0000000000190000-0x0000000000191000-memory.dmp
memory/1848-2-0x00000000724D0000-0x000000007334D000-memory.dmp
memory/1848-3-0x0000000000190000-0x0000000000191000-memory.dmp
memory/1848-5-0x0000000000190000-0x0000000000191000-memory.dmp
memory/1848-6-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/1848-8-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/1848-10-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/1848-30-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/1848-31-0x0000000000210000-0x0000000000211000-memory.dmp
memory/1848-33-0x0000000000210000-0x0000000000211000-memory.dmp
memory/1848-28-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/1848-25-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1848-23-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1848-35-0x0000000000210000-0x0000000000211000-memory.dmp
memory/1848-20-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/1848-18-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/1848-15-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/1848-13-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/1848-39-0x00000000724D0000-0x000000007334D000-memory.dmp