6bb390bddaaff3e75a6a2b1ecafa3f49bf6e4d93747302a6870698fb26285a32 | Triage

Analysis

max time kernel
138s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 20:50

Sharing

Report Analysis Logs

General

Target

VMProtectSDK32.dll
Size

108KB
MD5

ba83c922c8784b6878834341c7feaab5
SHA1

ae8d7e4f615f331cedbbff0a1c4de00299ba3ab4
SHA256

20c4f4cc603335ab39bffa24e335f4adee51b0520d12364d1070691b33216091
SHA512

331296af7431af0554e0300b0cd578adfadf866753fad9399ee378099d41f34ee6a0b7305f86f308eb8a9c8683dfd7b0ac7e31bc2b8f3110bb74e963c59a2c3e
SSDEEP

3072:3hQC2mCYK3RhrZ9dPk2Q9yMJwb0YRGRfxu:KnrZnjQ7Klx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	4716	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4716	2168	rundll32.exe	86
PID 2168 wrote to memory of 4716	2168	rundll32.exe	86
PID 2168 wrote to memory of 4716	2168	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtectSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtectSDK32.dll,#1
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 600
    3⤵
    - Program crash
    PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4716 -ip 4716
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads