05e42e22318cf8b56eee61bf6474de58eaba270d30e3c89631d33a28407d25e9 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 10:29

Sharing

Report Analysis Logs

General

Target

VC.dll
Size

108KB
MD5

8a1c9b6202155b325b637a80f06f7670
SHA1

d02c6c38ca5a7b76773a2afc7b992490ae2f5f7b
SHA256

d9d4657618820a70231c895b41581bff12d5b31fa50b5f24907e1864a048d311
SHA512

f39258540fdd7766849d12f222dd9e3d4ef8c4511e746875323be31b5691ac06a33cd1ea5b46b341c2a038b60a54058c7c652f47c3bb0077d6ad1cfe7843114b
SSDEEP

1536:U0V/T5qLDvRg89xWuBCZDf08mm9Jvq17lwbdOWcdsfSyOPwyN/D7K68on5y:123e89xWuMZrR+l8RcOfSy8NHws

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1196-1-0x0000000010000000-0x0000000010034000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28
PID 2020 wrote to memory of 1196	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VC.dll,#1
  2⤵
  PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-1-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download