27df4a63c80cda5fe053fe672fbc327bf268d8656c354099f004e41c3b95fb52

Analysis

Target
2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe
Size 3.5MB
Sample220512-hcbvwsagd7
SHA256 27df4a63c80cda5fe053fe672fbc327bf268d8656c354099f004e41c3b95fb52
MD5 2be4cba59cf9e4e0ea0ca3d27dc1ce48
SHA1 9fe40bdbefea9284b8e7b85712a4fde9dfa24136
SHA512 4e75a090b4fee113632c17ba3ab4fe4fafb0da89399f50a4022f01b83ef905200053cfd551c56dbdb71e3c5aca3bded872e78fe8a8d41074e6c246a914e235e3
MD5 SHA1 SHA512

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1268-54-0x0000000140000000-0x0000000140611000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	1268	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1336	1268	2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe	28
PID 1268 wrote to memory of 1336	1268	2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe	28
PID 1268 wrote to memory of 1336	1268	2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe	28

C:\Users\Admin\AppData\Local\Temp\2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe
"C:\Users\Admin\AppData\Local\Temp\2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1268 -s 448
  2⤵
  - Program crash
  PID:1336

memory/1268-54-0x0000000140000000-0x0000000140611000-memory.dmp

Download