8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-10-2022 21:55

Target

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
Size

3.0MB
MD5

9301f1da68cccfa053da550107f0365c
SHA1

39a92e81e6669611b8e494c3ca2853283316d801
SHA256

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
SHA512

1206145a834315b385b19d3cf58abc8d7b6cc46b9315db26e671ab598faf6eb3fa0aa5a932005f8f2f16832a84dfa9bf9593a907a256b6d9155a944753b5d494
SSDEEP

49152:c2lp5nsO1lERGmC7vK9y+QXMR1UEhLdPMRG4OU09Q1IFOUCGExQPr/E+Vm5tPXXq:/p9vjHp+QAUyGG4oQ1Ib1Yxt/Xq

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1724-55-0x0000000000400000-0x0000000000A85000-memory.dmp	vmprotect
behavioral1/memory/1724-57-0x0000000000400000-0x0000000000A85000-memory.dmp	vmprotect
behavioral1/memory/1724-60-0x0000000000400000-0x0000000000A85000-memory.dmp	vmprotect

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DNomb\Mpec.mbt	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
File opened for modification	C:\Windows\DNomb\Mpec.mbt	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 584	1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe	28
PID 1724 wrote to memory of 584	1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe	28
PID 1724 wrote to memory of 584	1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe	28
PID 1724 wrote to memory of 584	1724	8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe	28

C:\Users\Admin\AppData\Local\Temp\8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
"C:\Users\Admin\AppData\Local\Temp\8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
  2⤵
  PID:584

memory/1724-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000400000-0x0000000000A85000-memory.dmp

Filesize
6.5MB

Download
memory/1724-57-0x0000000000400000-0x0000000000A85000-memory.dmp

Filesize
6.5MB

Download
memory/1724-58-0x0000000074441000-0x0000000074443000-memory.dmp

Filesize
8KB

Download
memory/1724-60-0x0000000000400000-0x0000000000A85000-memory.dmp

Filesize
6.5MB

Download