e893dbe6b911e8faea85dad69061e2755ef52db23bc5163f7c5dfd4138f29d6e | Triage

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 14:08

Sharing

Report Analysis Logs

General

Target

kdump64.dll
Size

148KB
MD5

d5dcfc5ac42bcba55a1170756f3493f4
SHA1

1bcefa919e0c9c1d114ed6384e4aff8f316482de
SHA256

8ba00843b9aba2cff6f2234a7daf040aadfebce4c05b13061da63b48f63bfa4f
SHA512

dbaf78188b53629d667bdcb4fcdc0c35045e77330bbe209739c86fbe2d7c2ba04b3adeedc6576186e1af20f8eb373a9788ed3b0050f80f61485475dcf23b0a24
SSDEEP

3072:+hNbJ07kFlBFBTmIw61ReXqiZmh1rx3o1v6Al7JyvITb/:+nbOcB76IJPevmh46Al3

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/2404-0-0x00007FFFD2760000-0x00007FFFD27A4000-memory.dmp	vmprotect
behavioral2/memory/2404-1-0x00007FFFD2760000-0x00007FFFD27A4000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2404 rundll32.exe
2404 rundll32.exe
2404 rundll32.exe
2404 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kdump64.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x00007FFFD2760000-0x00007FFFD27A4000-memory.dmp

Filesize
272KB

Download
memory/2404-1-0x00007FFFD2760000-0x00007FFFD27A4000-memory.dmp

Filesize
272KB

Download
memory/2404-2-0x00007FFFDFF80000-0x00007FFFDFF81000-memory.dmp

Filesize
4KB

Download