60402ce9ace92fde371fadbf0dbdc7a7349905d61e5aa39d82375b0248cb86de

Analysis

max time kernel
38s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 20:10

Target

idk Spoofer V1.exe
Size

5.3MB
MD5

019e39a0c0c06f939ed3e9580067606f
SHA1

fed0a20e7e5a0d865e077b6df4c386d0d954bd64
SHA256

60402ce9ace92fde371fadbf0dbdc7a7349905d61e5aa39d82375b0248cb86de
SHA512

b36174628f7f1459d8f4ce6889e0fc95eccf1024fd53aaf2ea182834e44d08960988f0fc55799d82048ba92251b482948bcdb94bcc1be1d88cd171258d080ae1
SSDEEP

98304:iNl/m5UI+t7pnyzLjAtlZAoWmo0RD+T/E3qyyVsaDf3+GpBX5koX7r8i9L:iNl/3pyXMp3oE+TcaygsIvdpBXfn

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/5024-132-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp	vmprotect
behavioral1/memory/5024-138-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp	vmprotect
behavioral1/memory/5024-139-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5024	idk Spoofer V1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	idk Spoofer V1.exe
5024	idk Spoofer V1.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4692	5024	idk Spoofer V1.exe	82
PID 5024 wrote to memory of 4692	5024	idk Spoofer V1.exe	82
PID 5024 wrote to memory of 4668	5024	idk Spoofer V1.exe	83
PID 5024 wrote to memory of 4668	5024	idk Spoofer V1.exe	83
PID 5024 wrote to memory of 5040	5024	idk Spoofer V1.exe	84
PID 5024 wrote to memory of 5040	5024	idk Spoofer V1.exe	84

C:\Users\Admin\AppData\Local\Temp\idk Spoofer V1.exe
"C:\Users\Admin\AppData\Local\Temp\idk Spoofer V1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5040

memory/4668-136-0x0000000000000000-mapping.dmp

Download
memory/4692-135-0x0000000000000000-mapping.dmp

Download
memory/5024-132-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp

Filesize
8.9MB

Download
memory/5024-138-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp

Filesize
8.9MB

Download
memory/5024-139-0x00007FF730BE0000-0x00007FF7314CC000-memory.dmp

Filesize
8.9MB

Download
memory/5040-137-0x0000000000000000-mapping.dmp

Download