42e3b12880cbcecf93cc5d053ad7f9a3b41810abddda448309d240ef5eb93672 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 05:53

Sharing

Report Analysis Logs

General

Target

CSOM.dll
Size

432KB
MD5

fd66fef2fe170948c7f64d5d8ad95bed
SHA1

76d9a99c36f902fda382e7747aa74237578ea766
SHA256

c778bcbb503794ddcf0459e5a95706a766998309d1b3a9782cb3d6f106c26c89
SHA512

52607dc9ee1205d54c563d9cc3713918bc33018d3329553ea7e8c52ffc6fef38c1cfb904ffa3bc9621e276d7483d4d006e614dc872b0440d58ca6c374b425e6e
SSDEEP

12288:Z4/kB26domCT1D4WKe4gFjQL6HyHWgVteec2:B24oNezgFjQLQbgVl

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2116-0-0x0000000010000000-0x000000001153A000-memory.dmp	vmprotect
behavioral1/memory/2116-1-0x0000000010000000-0x000000001153A000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CSOM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CSOM.dll,#1
  2⤵
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000010000000-0x000000001153A000-memory.dmp

Filesize
21.2MB

Download
memory/2116-1-0x0000000010000000-0x000000001153A000-memory.dmp

Filesize
21.2MB

Download