05e42e22318cf8b56eee61bf6474de58eaba270d30e3c89631d33a28407d25e9

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 10:29

Target

quietus.dll
Size

40KB
MD5

0991d0ed778f21bbb9f3aa937c613aec
SHA1

a7ba801f55f3e7044bc14deef46fb275f653b6f8
SHA256

a7003bbf35309ff061a2f64161a088d1cf8e69a959c71d6ece50724192aecfc8
SHA512

c9835f557ab745ae1367b406eaf6f4b670466a11e92ee39bfd54c42e0e33263ed679274577c40e566b5c9f658512e5e04a3c5c2e9f42482da23e572f66ff70f7
SSDEEP

384:RahMr43T5LPMaanOg0sFoNQr7ruc8/l3jyuBSw0sPzOiuif5USPdvl1dZ51:7aTBPMvOzNQr2RjLSJsPzOirLFvlX1

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral4/memory/3484-0-0x0000000002D90000-0x0000000002DC4000-memory.dmp	vmprotect
behavioral4/memory/3484-1-0x0000000002D90000-0x0000000002DC4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3484	4828	rundll32.exe	94
PID 4828 wrote to memory of 3484	4828	rundll32.exe	94
PID 4828 wrote to memory of 3484	4828	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\quietus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\quietus.dll,#1
  2⤵
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1392

memory/3484-0-0x0000000002D90000-0x0000000002DC4000-memory.dmp

Filesize
208KB

Download
memory/3484-1-0x0000000002D90000-0x0000000002DC4000-memory.dmp

Filesize
208KB

Download