0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 05:16

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06.exe command="C:\Users\Admin\AppData\Local\Temp\0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06.exe
Size

326KB
MD5

08408c8a04fda522a397e2b26c6322b0
SHA1

e58226f7a02bc5148d58a264de25867b488e6adf
SHA256

0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06
SHA512

006cb5447345251c9c72daf13b3e21221b99b89a70b2813f132afc6a1d0cdd3bbe44aef6421bc324611a4634dbcc018695b54e01d618c9c7bdf0be7edb1c3d45
SSDEEP

6144:5DFrEz5FsL2vwNi/+po271dVAGp2pXThGFrDkyp0p0v01DwH2NGsmeKJ0pTAJXoJ:dq35qm+Kg52pXThGmyp80v018BWB+4lL

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1380-54-0x0000000000010000-0x0000000000061B80-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06.exe
"C:\Users\Admin\AppData\Local\Temp\0c4e947b2379780def0dd8f8b1748f31193be772c89fc4c5ae529bd7b0497c06.exe"
1⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x0000000000010000-0x0000000000061B80-memory.dmp

Filesize
326KB

Download