168def17ca34ac8e71b779064ddda9f3113ed4e4eb99dd24e25793d9ca6e64e1

Analysis

Target
c192ffb551e517687569449fb96f9acb.exe
Size 3.5MB
Sample220509-q89e2agcfm
SHA256 168def17ca34ac8e71b779064ddda9f3113ed4e4eb99dd24e25793d9ca6e64e1
MD5 c192ffb551e517687569449fb96f9acb
SHA1 38df064b4032ecdfb9226d6bdc6198c97f8d95b4
SHA512 a9cd5b1c34a8d926bb2614edff50694e9176e16a9c43d8b51690e1830dadf9447b68b3c2b726b647b95323e5d6e36549be5a5544272ec49cbeb0ace80b372ccb
MD5 SHA1 SHA512

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1100-54-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1100	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2012	1100	c192ffb551e517687569449fb96f9acb.exe	27
PID 1100 wrote to memory of 2012	1100	c192ffb551e517687569449fb96f9acb.exe	27
PID 1100 wrote to memory of 2012	1100	c192ffb551e517687569449fb96f9acb.exe	27

C:\Users\Admin\AppData\Local\Temp\c192ffb551e517687569449fb96f9acb.exe
"C:\Users\Admin\AppData\Local\Temp\c192ffb551e517687569449fb96f9acb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1100 -s 444
  2⤵
  - Program crash
  PID:2012

memory/1100-54-0x0000000140000000-0x000000014061C000-memory.dmp

Download