7f12c58d1b3ae938930c8f0f6ff4c25cf9db4018a134b8ec816790bb82b22cc4 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37a0637db70f9a7763de3ca1120a6e88.dll
Size

65KB
MD5

37a0637db70f9a7763de3ca1120a6e88
SHA1

540dddf906758abb39163193a732ae3254327628
SHA256

7f12c58d1b3ae938930c8f0f6ff4c25cf9db4018a134b8ec816790bb82b22cc4
SHA512

5ab5fd7771d84e5c444f4fefd7c969c04770f3d46fb4b9dc6c8180b4c434d3cf3e525eb1a52d76453db5f5fa65336a49b0556ef97e15985af257e1afc07c35fc
SSDEEP

1536:/DiBX5q3yM6GZdAg/1eFUi7LCM+53L3V2p2:/DwX5q3jZdH/1eFJCRRL

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1820-0-0x0000000010000000-0x0000000010022000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19
PID 2392 wrote to memory of 1820	2392	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a0637db70f9a7763de3ca1120a6e88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a0637db70f9a7763de3ca1120a6e88.dll,#1
  2⤵
  PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download