4bb31847846180bf78033b5eb7761b874b114f6dd086862472915be761fc042a | Triage

Analysis

max time kernel
42s
max time network
112s
platform
windows7_x64
resource
win7-20220414-en
submitted
09-06-2022 14:12

Sharing

Report Analysis Logs

General

Target

7zS8A52FD1B/62a1ea2d09364_3056ccd.exe
Size

3.7MB
MD5

e77f09a338e643ee05ad09e367eedf73
SHA1

6777cd291ece93e16aa95c3e60b63d46b1b142bd
SHA256

f32c3414f14e0b4c08183af08702736a2ed18c99101d5ee1bc5bc5e8ee3c8982
SHA512

53f59267e4bfe862e51edb0fd7d356485a7349e7ccd6439c6c88bda921a67909a36efd1690d06fe3c30c8a4433d5c4c1a34c30b928cb29ec45b08045ef4f5747

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral15/memory/1776-54-0x0000000140000000-0x000000014067D000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1176 1776 WerFault.exe 62a1ea2d09364_3056ccd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

62a1ea2d09364_3056ccd.exe

description	pid	process	target process
PID 1776 wrote to memory of 1176	1776	62a1ea2d09364_3056ccd.exe	WerFault.exe
PID 1776 wrote to memory of 1176	1776	62a1ea2d09364_3056ccd.exe	WerFault.exe
PID 1776 wrote to memory of 1176	1776	62a1ea2d09364_3056ccd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2d09364_3056ccd.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2d09364_3056ccd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1776 -s 448
2⤵
- Program crash
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-58-0x0000000000000000-mapping.dmp

Download
memory/1776-54-0x0000000140000000-0x000000014067D000-memory.dmp

Filesize
6.5MB

Download