dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 23:19

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf.exe command="C:\Users\Admin\AppData\Local\Temp\dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf.exe
Size

326KB
MD5

0c02f4df1c7f30aa87ec02df186396b0
SHA1

a594ef345beca2b228ae90a06e7b2e43cefad919
SHA256

dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf
SHA512

dd987c988f2e3c219ee5e03556a7d89cea69e5dd35e23b103700d59320522bbf181cfc09c05a0573a8f754a8f6a033dafc207c33aa69c175ad2b3c2ac8cb424a
SSDEEP

6144:NXxrEz5FsL2vwNi/+po271dVAGp2pXThGFrDkyp0p0v01DwH2NGsmeKJ0pTAJXoJ:FG35qm+Kg52pXThGmyp80v018BWB+4lL

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1204-54-0x0000000000010000-0x0000000000061B80-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf.exe
"C:\Users\Admin\AppData\Local\Temp\dbfe8d42b7bf9e0af2e000bb672884b7c99e9126bd25626b342d46b57a196eaf.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x0000000000010000-0x0000000000061B80-memory.dmp

Filesize
326KB

Download