22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845 | Triage

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-06-2022 06:16

Sharing

Report Analysis Logs

General

Target

22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe
Size

804KB
MD5

afd33b39cc87ff4d2e7047e199b911f0
SHA1

71adba01096df16f501b202b07d24d5c3fee37df
SHA256

22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845
SHA512

9802fdf92b9735740bf23b943fd9fa15c374d09a2a13c90823a96654cc0a3fd157148b9600153d66721ee57023227339c30bab4cc7780737cd8a0a9844be3671

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1948-55-0x0000000000400000-0x000000000064F000-memory.dmp	vmprotect
behavioral1/memory/1948-56-0x0000000000400000-0x000000000064F000-memory.dmp	vmprotect
behavioral1/memory/1948-59-0x0000000000400000-0x000000000064F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	1948	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2008	1948	22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe	28
PID 1948 wrote to memory of 2008	1948	22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe	28
PID 1948 wrote to memory of 2008	1948	22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe	28
PID 1948 wrote to memory of 2008	1948	22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe	28

C:\Users\Admin\AppData\Local\Temp\22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe
"C:\Users\Admin\AppData\Local\Temp\22221d5e43e091a1c03113d1bb37d8dd95dcf07d8756c87d2df6c0d1ab944845.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 184
  2⤵
  - Program crash
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/1948-56-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/1948-59-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download