731cbae14430bb27da84cda0e6c581170164a1dc38507e7c4d75eb56d4b4e0d6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 11:23

Target

gigni.dll
Size

5.6MB
MD5

f2e1d02808084a9201ac4547da5658d9
SHA1

54e2e512358a1f29f8af9607c7dc6dd7e34cb86f
SHA256

731cbae14430bb27da84cda0e6c581170164a1dc38507e7c4d75eb56d4b4e0d6
SHA512

1af971ca8d0e9be14591f09fd4fd9d09bc2506f28e647c334409984f11b1c5426b3401ae7fd01910d7b1b1fd538ba5f83811c9b8bcfd56ba84013b75b0c5bf9f
SSDEEP

98304:VBdRN4Crhg3z/SDhU+eSVMlKXfur2EZ8N1gbSTKqjvGO90xEAxudOA+4dbyLpla3:ZsCS3z/wUTZwXfeigbSTeOmxfk9+0uj

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral1/memory/1592-5-0x00000000738B0000-0x0000000074239000-memory.dmp vmprotect
behavioral1/memory/1592-9-0x00000000738B0000-0x0000000074239000-memory.dmp vmprotect
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1592 rundll32.exe
1592 rundll32.exe

resource	yara_rule
behavioral1/memory/1592-5-0x00000000738B0000-0x0000000074239000-memory.dmp	vmprotect
behavioral1/memory/1592-9-0x00000000738B0000-0x0000000074239000-memory.dmp	vmprotect

pid	process
1592	rundll32.exe
1592	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1592	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gigni.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gigni.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

memory/1592-7-0x0000000073953000-0x0000000073C97000-memory.dmp

Filesize
3.3MB

Download
memory/1592-5-0x00000000738B0000-0x0000000074239000-memory.dmp

Filesize
9.5MB

Download
memory/1592-4-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1592-2-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1592-9-0x00000000738B0000-0x0000000074239000-memory.dmp

Filesize
9.5MB

Download
memory/1592-0-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download