Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:53

General

  • Target

    Debug/ForlornInject.dll

  • Size

    6.3MB

  • MD5

    4c6905c9ca12050b9a1dca9853396461

  • SHA1

    cbaf1d75c733136e5e83f3a8d317f644fbcb1c46

  • SHA256

    1e09bd583e6e5cb359d19d6d88f983f35612fbc395ac3e387d70807efbbffd9a

  • SHA512

    3391e28d30108f193787e2900d27419c08fb3a7b720b5b6f962ccb1551deaa5ef1a43695650359b716571a48a7eb4ebed0311c11a9b97f4d89de38544c20f964

  • SSDEEP

    196608:MarThuGIJyYb/fS88Av/d9QSHyM0zavkc:drTpebytKUIyDaV

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\ForlornInject.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-0-0x00007FF83DBF9000-0x00007FF83DEB5000-memory.dmp

    Filesize

    2.7MB

  • memory/1084-1-0x00007FF85BE10000-0x00007FF85BE12000-memory.dmp

    Filesize

    8KB

  • memory/1084-4-0x00007FF85A0F0000-0x00007FF85A0F2000-memory.dmp

    Filesize

    8KB

  • memory/1084-6-0x00007FF859870000-0x00007FF859872000-memory.dmp

    Filesize

    8KB

  • memory/1084-5-0x00007FF859860000-0x00007FF859862000-memory.dmp

    Filesize

    8KB

  • memory/1084-3-0x00007FF85A0E0000-0x00007FF85A0E2000-memory.dmp

    Filesize

    8KB

  • memory/1084-2-0x00007FF85BE20000-0x00007FF85BE22000-memory.dmp

    Filesize

    8KB

  • memory/1084-7-0x00007FF83D610000-0x00007FF83E50C000-memory.dmp

    Filesize

    15.0MB

  • memory/1084-11-0x00000216F9040000-0x00000216F910D000-memory.dmp

    Filesize

    820KB

  • memory/1084-12-0x00007FF83DBF9000-0x00007FF83DEB5000-memory.dmp

    Filesize

    2.7MB