Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 05:53

General

  • Target

    4fc213c5beec0a48c992cc16147bd898.dll

  • Size

    458KB

  • MD5

    4fc213c5beec0a48c992cc16147bd898

  • SHA1

    d078e20725cdd69ef19feff5ccb74a8eebbe7a2a

  • SHA256

    a009833a53432868463134a6df8b017b744c4392b80d2446a33a71ee9f51cada

  • SHA512

    730195cd83e3474f9ad9be3b4ce0f8a0144242ee85212f00b65c1c2a0ab71073afbafb6e76a2d2103fa4153623e9d8149b605874718c3f54c0374efa89f2679f

  • SSDEEP

    6144:wpk16OPyxES6t7kxrpZDGI9VSgljHRCp8vohC3WeyZzqT0ouGCOuOy3wH1Pc:aQ6Eyz6pknZSMogF4IoggouGnrH1Pc

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fc213c5beec0a48c992cc16147bd898.dll,#1
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1888 -s 240
      2⤵
        PID:2792

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1888-0-0x000007FEF7450000-0x000007FEF74CD000-memory.dmp

            Filesize

            500KB

          • memory/1888-1-0x000007FEFAED0000-0x000007FEFAF4D000-memory.dmp

            Filesize

            500KB

          • memory/1888-3-0x000007FEFAED0000-0x000007FEFAF4D000-memory.dmp

            Filesize

            500KB

          • memory/1888-2-0x000007FEF7450000-0x000007FEF74CD000-memory.dmp

            Filesize

            500KB

          • memory/1888-4-0x000007FEF7450000-0x000007FEF74CD000-memory.dmp

            Filesize

            500KB