05e42e22318cf8b56eee61bf6474de58eaba270d30e3c89631d33a28407d25e9 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 10:29

Sharing

Report Analysis Logs

General

Target

VC.dll
Size

108KB
MD5

8a1c9b6202155b325b637a80f06f7670
SHA1

d02c6c38ca5a7b76773a2afc7b992490ae2f5f7b
SHA256

d9d4657618820a70231c895b41581bff12d5b31fa50b5f24907e1864a048d311
SHA512

f39258540fdd7766849d12f222dd9e3d4ef8c4511e746875323be31b5691ac06a33cd1ea5b46b341c2a038b60a54058c7c652f47c3bb0077d6ad1cfe7843114b
SSDEEP

1536:U0V/T5qLDvRg89xWuBCZDf08mm9Jvq17lwbdOWcdsfSyOPwyN/D7K68on5y:123e89xWuMZrR+l8RcOfSy8NHws

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/220-1-0x0000000010000000-0x0000000010034000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 220	5080	rundll32.exe	88
PID 5080 wrote to memory of 220	5080	rundll32.exe	88
PID 5080 wrote to memory of 220	5080	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VC.dll,#1
  2⤵
  PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-1-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download