50c0fe37a73271624a9aebfc93fd445a156b760c363d04edef4ff28e2b11a13f | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48c4dab6e5bea589a22fc80d095594e2.dll
Size

76KB
MD5

48c4dab6e5bea589a22fc80d095594e2
SHA1

24b779dfb94c6d6687753c8d07ecbdf8e297c848
SHA256

50c0fe37a73271624a9aebfc93fd445a156b760c363d04edef4ff28e2b11a13f
SHA512

ed755492bd4216f359f7da3490a304ff4fb0e8b7bc30d661d9c6ebf8a7936c2f15dafc473faa3508f7c030ebb45ffe2b92e1343d595df2993577a1c10c28d40f
SSDEEP

1536:yNlfjeFrVQjBAuzFnToIfreQG654B+D5chcFFV7D+:y7BBAuztTBfref1Vmo

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/624-0-0x0000000010000000-0x0000000010018000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14
PID 2420 wrote to memory of 624	2420	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c4dab6e5bea589a22fc80d095594e2.dll,#1
1⤵
PID:624

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c4dab6e5bea589a22fc80d095594e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/624-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download