4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5 | Triage

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 21:11

Sharing

Report Analysis Logs

General

Target

PL/pb1115.exe
Size

3.5MB
MD5

04aeaa8f06b71a72b8905da20f679b10
SHA1

ebfa60215fcce5a369f1b340f1232125e37f7a68
SHA256

55c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383
SHA512

5c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774
SSDEEP

98304:l1kvho0RcPjNWqCdGujwByZm94cGZ+qOUKsE:fkZtcPjNW/GowUE9W+DUK

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral9/memory/748-54-0x0000000140000000-0x000000014060D000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 748 WerFault.exe pb1115.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

pb1115.exe

description	pid	process	target process
PID 748 wrote to memory of 1504	748	pb1115.exe	WerFault.exe
PID 748 wrote to memory of 1504	748	pb1115.exe	WerFault.exe
PID 748 wrote to memory of 1504	748	pb1115.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe
"C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 748 -s 100
2⤵
- Program crash
PID:1504

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000140000000-0x000000014060D000-memory.dmp

Filesize
6.1MB

Download
memory/1504-58-0x0000000000000000-mapping.dmp

Download