e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:35

Target

e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe
Size

560KB
MD5

177eea47c7137b02215be8da20eabb7c
SHA1

f32e6b5596a8ba83df4c31a5a92700496a898fa6
SHA256

e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068
SHA512

4ea0959a98e72fd35a60e849c8f476d9d25c189c8b06ae5c657d36b6c8a1e9ef2f76e808dddb45b95de95e3f80ba6f13d88bcfa15c9fa3881e3f58af952de471
SSDEEP

12288:wTHw8041PY59Z7Nas0D3UlZzhLsVx2JqDJectaRA2Z5JcZa9:Tl59ZCbGFhEx2qJect8Z5O

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1768-54-0x0000000000400000-0x0000000000563000-memory.dmp	vmprotect
behavioral1/memory/1768-58-0x0000000000400000-0x0000000000563000-memory.dmp	vmprotect
behavioral1/memory/1768-59-0x0000000000400000-0x0000000000563000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe

pid process

1768 e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe

pid	process
1768	e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe

C:\Users\Admin\AppData\Local\Temp\e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe
"C:\Users\Admin\AppData\Local\Temp\e6bff5d5b36f59e46635ea6e03b3b66aace8561f2d1c4d1e5394f546168ab068.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1768

memory/1768-54-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1768-58-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1768-59-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download