6c49edabd61702b5254163c19c7fedb5f009730cb1eb63e9f97f2a760cfbeaed

Analysis

Target
b9a2646176edb6b2b3ae232625b32b25.exe
Size 3.7MB
Sample220609-py3n3agbdq
SHA256 6c49edabd61702b5254163c19c7fedb5f009730cb1eb63e9f97f2a760cfbeaed
MD5 b9a2646176edb6b2b3ae232625b32b25
SHA1 8817e025fec7dec840f31dc1bdb6f2fe94dc9b06
SHA512 a83ecf4de893b30f91731c6a96311e7d6d05259a35896ea8dbb7b51cb1a2f1af33b98992d8b3612c98320eed86fe0a0b5226af17791bfd7bb272f7208945c7e7
MD5 SHA1 SHA512

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/272-54-0x0000000140000000-0x0000000140678000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	272	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1804	272	b9a2646176edb6b2b3ae232625b32b25.exe	27
PID 272 wrote to memory of 1804	272	b9a2646176edb6b2b3ae232625b32b25.exe	27
PID 272 wrote to memory of 1804	272	b9a2646176edb6b2b3ae232625b32b25.exe	27

C:\Users\Admin\AppData\Local\Temp\b9a2646176edb6b2b3ae232625b32b25.exe
"C:\Users\Admin\AppData\Local\Temp\b9a2646176edb6b2b3ae232625b32b25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 272 -s 448
  2⤵
  - Program crash
  PID:1804

memory/272-54-0x0000000140000000-0x0000000140678000-memory.dmp

Download