69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 05:14

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe command="C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe
Size

304KB
MD5

216da8cc109ffba03780d150cb7ad290
SHA1

b8869f325bf32666a14e171d03ad267f16ef3b11
SHA256

69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206
SHA512

5a7a191e242766215e7b12398cb86c08ce6e9ce4dc34eff1ec900f5212064f0a1c006382aa6504d11f967381dfa5f70e2a56e592abdaa8dd6d85ed18ba18a1ec
SSDEEP

6144:8Kd63l2X43/WuoOqxOcPungG4M7RIe8vZ6CP1w8u2cR8Zuogzsv0buWsPk:K2X4+Rr8rgGl1Ie8vZ3P1w8+R8kogxyc

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1308-54-0x0000000000010000-0x000000000005C180-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe
"C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe"
1⤵
PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000000010000-0x000000000005C180-memory.dmp

Filesize
304KB

Download