216fd41659dede11cb6972ce5e5fc5889004d27f23f281f231ffd91e13336a52 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de599d29ebe57287e8020ea5c5a721db.dll
Size

104KB
MD5

de599d29ebe57287e8020ea5c5a721db
SHA1

c11dc8ee222dbc0190765523f09cead6277a6c32
SHA256

216fd41659dede11cb6972ce5e5fc5889004d27f23f281f231ffd91e13336a52
SHA512

998c2cb5f97ea6a687574d18ff1d870790efb3b9cac0ad97cbeedd4644415bc929fc2db8687a364a8328187d4b93df56578f3b8520a884ae884e03260c57c282
SSDEEP

3072:vRYZjxBdF23zEmVHG2z+xS5D+p33RHjcBus:vRYZVh2lVh+x8+pHR4B

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/5104-0-0x0000000010000000-0x0000000010036000-memory.dmp	vmprotect
behavioral2/memory/5104-1-0x0000000010000000-0x0000000010036000-memory.dmp	vmprotect
behavioral2/memory/5104-2-0x0000000010000000-0x0000000010036000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 5104	4036	rundll32.exe	89
PID 4036 wrote to memory of 5104	4036	rundll32.exe	89
PID 4036 wrote to memory of 5104	4036	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de599d29ebe57287e8020ea5c5a721db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de599d29ebe57287e8020ea5c5a721db.dll,#1
  2⤵
  PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/5104-1-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/5104-2-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download