339a99e02bc7c6dd33c96d37887539f92596b422e4d2f25a6eb01642d2a797ea

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 09:59

Target

339a99e02bc7c6dd33c96d37887539f92596b422e4d2f25a6eb01642d2a797ea.exe
Size

62KB
MD5

8052977c30984112b15567626f73a4d0
SHA1

d5cf34194410dbfa488006df4fd93725b903a8ff
SHA256

339a99e02bc7c6dd33c96d37887539f92596b422e4d2f25a6eb01642d2a797ea
SHA512

748c404c620ee11cb8612dc4755a6d799beaf1b44ad4a69101d5e1383e402782c528b1f326259f2255ec2c89db090dc8ccc6d01c980d3a65d4c34f6f009a995d
SSDEEP

1536:WMTqnJX6h3zjFO91l62I1oIIBSUNBxaB8+euIrUbl:W9nJ6h39OE5ofBSUbsBIra

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3304-132-0x0000000000400000-0x000000000041F000-memory.dmp	vmprotect
behavioral2/memory/3304-133-0x0000000000400000-0x000000000041F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	3304	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\339a99e02bc7c6dd33c96d37887539f92596b422e4d2f25a6eb01642d2a797ea.exe
"C:\Users\Admin\AppData\Local\Temp\339a99e02bc7c6dd33c96d37887539f92596b422e4d2f25a6eb01642d2a797ea.exe"
1⤵
PID:3304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 292
  2⤵
  - Program crash
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3304 -ip 3304
1⤵
PID:3696

memory/3304-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3304-133-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download