9137883dd44d2a5018d1f451263e556981c46c3ea145a6d5f25efd2e3155f49a

Resubmissions

07-09-2022 19:25

07-09-2022 19:22

max time kernel
98s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-09-2022 19:25

Target

Exploiter.exe
Size

5.2MB
MD5

258059934e8b24726faf22d8025dcea5
SHA1

9eba38ba23b1e1d4cc38e10bd6e50057b2cd4688
SHA256

9137883dd44d2a5018d1f451263e556981c46c3ea145a6d5f25efd2e3155f49a
SHA512

ba6dafbf9af8b543f3e8695f282ae48ae83f4cd15caa38edb674cfb119523f7332c3c092902c98368fd99f47b06f2878de5afb54fc7122a5cfd2ee1e3ddc131b
SSDEEP

98304:Slu6B6Vyqr900nM57VNfIk68oUlijKR/K/jLXkBonES0eu49SnxB5pcE:pZxtMVVNgX8oUlijKR/crkBonES0bf5B

Score

8^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1480-54-0x000000013FAC0000-0x0000000140365000-memory.dmp	vmprotect
behavioral1/memory/1480-55-0x000000013FAC0000-0x0000000140365000-memory.dmp	vmprotect
behavioral1/memory/1480-56-0x000000013FAC0000-0x0000000140365000-memory.dmp	vmprotect
behavioral1/memory/1480-58-0x000000013FAC0000-0x0000000140365000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	Exploiter.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1952	1480	Exploiter.exe	28
PID 1480 wrote to memory of 1952	1480	Exploiter.exe	28
PID 1480 wrote to memory of 1952	1480	Exploiter.exe	28

C:\Users\Admin\AppData\Local\Temp\Exploiter.exe
"C:\Users\Admin\AppData\Local\Temp\Exploiter.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1952

memory/1480-54-0x000000013FAC0000-0x0000000140365000-memory.dmp

Filesize
8.6MB

Download
memory/1480-55-0x000000013FAC0000-0x0000000140365000-memory.dmp

Filesize
8.6MB

Download
memory/1480-56-0x000000013FAC0000-0x0000000140365000-memory.dmp

Filesize
8.6MB

Download
memory/1480-58-0x000000013FAC0000-0x0000000140365000-memory.dmp

Filesize
8.6MB

Download
memory/1952-57-0x0000000000000000-mapping.dmp

Download