21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2

Analysis

max time kernel
62s
max time network
81s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 11:59

Target

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
Size

2.8MB
MD5

214237810988442ddf28c84248b7e769
SHA1

fb110d97bed03b26bdbc64dda62522716716e95b
SHA256

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2
SHA512

f2bab2c8576c78629471fe2a611e16182ddb82fc29dd1eea07eca8e0b253fff8df74e2b1527b00593b6ba99d5294d4ebecae6a79fbf2e776b90e4a49fe471879
SSDEEP

49152:D2ZJXlXJAFmFMg3+n4OyRhC/4ydKzYvLPhqyd7uY6v+50nJfE3n:D2ZzFJK4s4sMchqydKW5eJfE3n

Score

8^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/956-55-0x0000000000F40000-0x00000000015CD000-memory.dmp	vmprotect
behavioral1/memory/956-56-0x0000000000F40000-0x00000000015CD000-memory.dmp	vmprotect
behavioral1/memory/956-60-0x0000000000F40000-0x00000000015CD000-memory.dmp	vmprotect
behavioral1/memory/956-61-0x0000000000F40000-0x00000000015CD000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

964 956 WerFault.exe 21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid process

956 21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid process

956 21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid	pid_target	process	target process
964	956	WerFault.exe	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid	process
956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid	process
956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

description	pid	process	target process
PID 956 wrote to memory of 964	956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe
PID 956 wrote to memory of 964	956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe
PID 956 wrote to memory of 964	956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe
PID 956 wrote to memory of 964	956	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 860
2⤵
- Program crash
PID:964

memory/956-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/956-55-0x0000000000F40000-0x00000000015CD000-memory.dmp

Filesize
6.6MB

Download
memory/956-56-0x0000000000F40000-0x00000000015CD000-memory.dmp

Filesize
6.6MB

Download
memory/956-60-0x0000000000F40000-0x00000000015CD000-memory.dmp

Filesize
6.6MB

Download
memory/956-61-0x0000000000F40000-0x00000000015CD000-memory.dmp

Filesize
6.6MB

Download
memory/964-62-0x0000000000000000-mapping.dmp

Download