6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3

Analysis

Target

4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Size

5.4MB
MD5

fdf9641f354987fe4683a27c5eb160a7
SHA1

ad738fd0a7d076575ffb7ab338fb784bab739435
SHA256

4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072
SHA512

e0f251bd52b38ecb41a001f117de7d14e702b9aca5090bc01df96eb24679d32f68cf4a7da6cb961a147a67202cf4267dca44f4a2acc0bf1dedaf30d555d13315

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral12/memory/1680-117-0x00000000012A0000-0x0000000001B4A000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 1680 WerFault.exe 4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe

pid	pid_target	process	target process
2784	1680	WerFault.exe	4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exeWerFault.exe

pid	process
1680	4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
1680	4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2784 WerFault.exe
Token: SeBackupPrivilege 2784 WerFault.exe
Token: SeDebugPrivilege 2784 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
"C:\Users\Admin\AppData\Local\Temp\4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680

memory/1680-117-0x00000000012A0000-0x0000000001B4A000-memory.dmp

Filesize
8.7MB

Download
memory/1680-118-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download