3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 23:56

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479.exe command="C:\Users\Admin\AppData\Local\Temp\3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479.exe
Size

326KB
MD5

0678fdbde1cd0e4ba689d570c578b8d0
SHA1

bada441368dc3e9f7c9bb0669d6da012a013e487
SHA256

3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479
SHA512

deb9f541174e22951c700f2e8211d970857653ed70328b3c57201a1554c38a10b63e66870fbab7bbedba7d3ffdcea0d225c900c90a0114f2e52f1e23136d23e6
SSDEEP

6144:IW/rEz5FsL2vwNi/+po271dVAGp2pXThGFrDkyp0p0v01DwH2NGsmeKJ0pTAJXoJ:9g35qm+Kg52pXThGmyp80v018BWB+4lL

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1872-54-0x0000000000010000-0x0000000000061B80-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479.exe
"C:\Users\Admin\AppData\Local\Temp\3a6bd9ba4ba7f00bc73a77a2bdfe0ab9b13f23204d8b5ab38e2f3dd42104a479.exe"
1⤵
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-54-0x0000000000010000-0x0000000000061B80-memory.dmp

Filesize
326KB

Download