9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06

Analysis

max time kernel
164s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:30

Target

夢魔个人远控GHOST+.3.78美化版/夢魔个人远控GHOST .3.78美化版.exe
Size

2.6MB
MD5

0eb7116e688d326570d76552b064e93d
SHA1

35a4d1f9c53aa0696573af96a28173c6ee961e51
SHA256

55a139e6f4c5fb4a6779370c2080aa7d684730a8215524f81cf37a3854ae3767
SHA512

ad4e3562122c67d42ca6d9e997030745bfd51469706ca6f6ca4f39a3a8f436b6882d30d5c53a0d3056bddfd1368794e10a4d130227622fd6f71d7841137d6ff6
SSDEEP

49152:U66M51oxJrgXaxyyxFMWWymDecmfQeTCdCatlnzTK7a:kMr4JpXxFMWZxtYeOgat9iG

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral18/memory/2820-132-0x0000000000400000-0x0000000000A45000-memory.dmp	vmprotect
behavioral18/memory/2820-135-0x0000000000400000-0x0000000000A45000-memory.dmp	vmprotect
behavioral18/memory/2820-139-0x0000000000400000-0x0000000000A45000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1828 2820 WerFault.exe 夢魔个人远控GHOST .3.78美化版.exe

pid	pid_target	process	target process
1828	2820	WerFault.exe	夢魔个人远控GHOST .3.78美化版.exe

C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\夢魔个人远控GHOST .3.78美化版.exe
"C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\夢魔个人远控GHOST .3.78美化版.exe"
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 564
2⤵
- Program crash
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2820 -ip 2820
1⤵
PID:2940

memory/2820-132-0x0000000000400000-0x0000000000A45000-memory.dmp

Filesize
6.3MB

Download
memory/2820-133-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download
memory/2820-134-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download
memory/2820-136-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download
memory/2820-135-0x0000000000400000-0x0000000000A45000-memory.dmp

Filesize
6.3MB

Download
memory/2820-139-0x0000000000400000-0x0000000000A45000-memory.dmp

Filesize
6.3MB

Download