42e3b12880cbcecf93cc5d053ad7f9a3b41810abddda448309d240ef5eb93672 | Triage

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 05:53

Sharing

Report Analysis Logs

General

Target

CSOM.dll
Size

432KB
MD5

fd66fef2fe170948c7f64d5d8ad95bed
SHA1

76d9a99c36f902fda382e7747aa74237578ea766
SHA256

c778bcbb503794ddcf0459e5a95706a766998309d1b3a9782cb3d6f106c26c89
SHA512

52607dc9ee1205d54c563d9cc3713918bc33018d3329553ea7e8c52ffc6fef38c1cfb904ffa3bc9621e276d7483d4d006e614dc872b0440d58ca6c374b425e6e
SSDEEP

12288:Z4/kB26domCT1D4WKe4gFjQL6HyHWgVteec2:B24oNezgFjQLQbgVl

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4044-0-0x0000000010000000-0x000000001153A000-memory.dmp	vmprotect
behavioral2/memory/4044-1-0x0000000010000000-0x000000001153A000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	4044	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4044	1592	rundll32.exe	86
PID 1592 wrote to memory of 4044	1592	rundll32.exe	86
PID 1592 wrote to memory of 4044	1592	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CSOM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CSOM.dll,#1
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 604
    3⤵
    - Program crash
    PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4044 -ip 4044
1⤵
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-0-0x0000000010000000-0x000000001153A000-memory.dmp

Filesize
21.2MB

Download
memory/4044-1-0x0000000010000000-0x000000001153A000-memory.dmp

Filesize
21.2MB

Download