Analysis

  • max time kernel
    0s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 05:14

Errors

Reason
platform exec: image=C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe command="C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

General

  • Target

    69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe

  • Size

    304KB

  • MD5

    216da8cc109ffba03780d150cb7ad290

  • SHA1

    b8869f325bf32666a14e171d03ad267f16ef3b11

  • SHA256

    69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206

  • SHA512

    5a7a191e242766215e7b12398cb86c08ce6e9ce4dc34eff1ec900f5212064f0a1c006382aa6504d11f967381dfa5f70e2a56e592abdaa8dd6d85ed18ba18a1ec

  • SSDEEP

    6144:8Kd63l2X43/WuoOqxOcPungG4M7RIe8vZ6CP1w8u2cR8Zuogzsv0buWsPk:K2X4+Rr8rgGl1Ie8vZ3P1w8+R8kogxyc

Score
8/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe
    "C:\Users\Admin\AppData\Local\Temp\69ed5a64ec0f99908b2a67f945411c32f91f26ad3dee45261b5c5e0732f7d206.exe"
    1⤵
      PID:1308

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1308-54-0x0000000000010000-0x000000000005C180-memory.dmp

      Filesize

      304KB