dd112bfd7911a42d69b370c981ba55c1f1e3e00a671e764c0f1868a928b1fcd5

Analysis

Target
bf22196d70fbd83cb4b311d2ebf444ef.exe
Size 3.7MB
Sample220715-ej4mpsdddr
SHA256 dd112bfd7911a42d69b370c981ba55c1f1e3e00a671e764c0f1868a928b1fcd5
MD5 bf22196d70fbd83cb4b311d2ebf444ef
SHA1 b1f91a71dddf3720b40692559bfd53310b6b8ef3
SHA512 b1950aea1cb3d690dc13fdac19dc5d794b00439a9ce84417531131f5b5c400c0daa6e0ed461f2d8b2dba6aafb9f101efdde6fd3a8c0fab3581cf7373bd3a0a29
MD5 SHA1 SHA512

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/384-54-0x0000000140000000-0x0000000140688000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	384	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1636	384	bf22196d70fbd83cb4b311d2ebf444ef.exe	28
PID 384 wrote to memory of 1636	384	bf22196d70fbd83cb4b311d2ebf444ef.exe	28
PID 384 wrote to memory of 1636	384	bf22196d70fbd83cb4b311d2ebf444ef.exe	28

C:\Users\Admin\AppData\Local\Temp\bf22196d70fbd83cb4b311d2ebf444ef.exe
"C:\Users\Admin\AppData\Local\Temp\bf22196d70fbd83cb4b311d2ebf444ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 384 -s 356
  2⤵
  - Program crash
  PID:1636

memory/384-54-0x0000000140000000-0x0000000140688000-memory.dmp

Download