05e42e22318cf8b56eee61bf6474de58eaba270d30e3c89631d33a28407d25e9

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 10:29

Target

quietus.dll
Size

40KB
MD5

0991d0ed778f21bbb9f3aa937c613aec
SHA1

a7ba801f55f3e7044bc14deef46fb275f653b6f8
SHA256

a7003bbf35309ff061a2f64161a088d1cf8e69a959c71d6ece50724192aecfc8
SHA512

c9835f557ab745ae1367b406eaf6f4b670466a11e92ee39bfd54c42e0e33263ed679274577c40e566b5c9f658512e5e04a3c5c2e9f42482da23e572f66ff70f7
SSDEEP

384:RahMr43T5LPMaanOg0sFoNQr7ruc8/l3jyuBSw0sPzOiuif5USPdvl1dZ51:7aTBPMvOzNQr2RjLSJsPzOirLFvlX1

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral3/memory/2712-1-0x0000000000120000-0x0000000000154000-memory.dmp	vmprotect
behavioral3/memory/2712-0-0x0000000000120000-0x0000000000154000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28
PID 2520 wrote to memory of 2712	2520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\quietus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\quietus.dll,#1
  2⤵
  PID:2712

memory/2712-1-0x0000000000120000-0x0000000000154000-memory.dmp

Filesize
208KB

Download
memory/2712-0-0x0000000000120000-0x0000000000154000-memory.dmp

Filesize
208KB

Download