731cbae14430bb27da84cda0e6c581170164a1dc38507e7c4d75eb56d4b4e0d6

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 11:23

Target

gigni.dll
Size

5.6MB
MD5

f2e1d02808084a9201ac4547da5658d9
SHA1

54e2e512358a1f29f8af9607c7dc6dd7e34cb86f
SHA256

731cbae14430bb27da84cda0e6c581170164a1dc38507e7c4d75eb56d4b4e0d6
SHA512

1af971ca8d0e9be14591f09fd4fd9d09bc2506f28e647c334409984f11b1c5426b3401ae7fd01910d7b1b1fd538ba5f83811c9b8bcfd56ba84013b75b0c5bf9f
SSDEEP

98304:VBdRN4Crhg3z/SDhU+eSVMlKXfur2EZ8N1gbSTKqjvGO90xEAxudOA+4dbyLpla3:ZsCS3z/wUTZwXfeigbSTeOmxfk9+0uj

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/1644-2-0x0000000074A90000-0x0000000075419000-memory.dmp vmprotect
behavioral2/memory/1644-5-0x0000000074A90000-0x0000000075419000-memory.dmp vmprotect
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe
1644 rundll32.exe
1644 rundll32.exe
1644 rundll32.exe

resource	yara_rule
behavioral2/memory/1644-2-0x0000000074A90000-0x0000000075419000-memory.dmp	vmprotect
behavioral2/memory/1644-5-0x0000000074A90000-0x0000000075419000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2480 wrote to memory of 1644	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 1644	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 1644	2480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gigni.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gigni.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644

memory/1644-2-0x0000000074A90000-0x0000000075419000-memory.dmp

Filesize
9.5MB

Download
memory/1644-4-0x0000000074B33000-0x0000000074E77000-memory.dmp

Filesize
3.3MB

Download
memory/1644-5-0x0000000074A90000-0x0000000075419000-memory.dmp

Filesize
9.5MB

Download
memory/1644-0-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download