c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259

Analysis

max time kernel
112s
max time network
112s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 19:06

Target

Plasma.exe
Size

187KB
MD5

4d52a9b6c7929f699c0b331e9cbe7acc
SHA1

9ef3fe56b739ad6ddeb1e3dba83eb70593d1cfde
SHA256

c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259
SHA512

69c9c3a52e4d736c19352db2a3233df9ae3a11b879b5075e4a5173b4b36e3533f40a1d72173638a9f997bbf89f7a1637e86afaf49a2894677b0e986f66f64031

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1800-54-0x0000000000CD0000-0x0000000000D14000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1976 1800 WerFault.exe Plasma.exe

pid	pid_target	process	target process
1976	1800	WerFault.exe	Plasma.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Plasma.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Plasma.exe

description pid process

Token: SeDebugPrivilege 1800 Plasma.exe

description	pid	process
Token: SeDebugPrivilege	1800	Plasma.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Plasma.exe

description	pid	process	target process
PID 1800 wrote to memory of 1976	1800	Plasma.exe	WerFault.exe
PID 1800 wrote to memory of 1976	1800	Plasma.exe	WerFault.exe
PID 1800 wrote to memory of 1976	1800	Plasma.exe	WerFault.exe
PID 1800 wrote to memory of 1976	1800	Plasma.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1112
2⤵
- Program crash
PID:1976

memory/1800-54-0x0000000000CD0000-0x0000000000D14000-memory.dmp

Filesize
272KB

Download
memory/1800-56-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1800-57-0x0000000009035000-0x0000000009046000-memory.dmp

Filesize
68KB

Download
memory/1800-58-0x0000000009035000-0x0000000009046000-memory.dmp

Filesize
68KB

Download
memory/1976-59-0x0000000000000000-mapping.dmp

Download