21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 11:59

Target

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
Size

2.8MB
MD5

214237810988442ddf28c84248b7e769
SHA1

fb110d97bed03b26bdbc64dda62522716716e95b
SHA256

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2
SHA512

f2bab2c8576c78629471fe2a611e16182ddb82fc29dd1eea07eca8e0b253fff8df74e2b1527b00593b6ba99d5294d4ebecae6a79fbf2e776b90e4a49fe471879
SSDEEP

49152:D2ZJXlXJAFmFMg3+n4OyRhC/4ydKzYvLPhqyd7uY6v+50nJfE3n:D2ZzFJK4s4sMchqydKW5eJfE3n

Score

8^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3612-132-0x0000000000170000-0x00000000007FD000-memory.dmp	vmprotect
behavioral2/memory/3612-133-0x0000000000170000-0x00000000007FD000-memory.dmp	vmprotect
behavioral2/memory/3612-137-0x0000000000170000-0x00000000007FD000-memory.dmp	vmprotect
behavioral2/memory/3612-138-0x0000000000170000-0x00000000007FD000-memory.dmp	vmprotect
behavioral2/memory/3612-140-0x0000000000170000-0x00000000007FD000-memory.dmp	vmprotect

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3704	3612	WerFault.exe	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
4360	3612	WerFault.exe	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid	process
3612	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe
3612	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

pid process

3612 21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe

description	pid	process	target process
PID 3612 wrote to memory of 3704	3612	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe
PID 3612 wrote to memory of 3704	3612	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe
PID 3612 wrote to memory of 3704	3612	21777e8cab786d58de3d44087abc71e6d19f8a0a6ccaef2275a522b7a45d30b2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1292
2⤵
- Program crash
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1292
2⤵
- Program crash
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3612 -ip 3612
1⤵
PID:5024

memory/3612-132-0x0000000000170000-0x00000000007FD000-memory.dmp

Filesize
6.6MB

Download
memory/3612-133-0x0000000000170000-0x00000000007FD000-memory.dmp

Filesize
6.6MB

Download
memory/3612-137-0x0000000000170000-0x00000000007FD000-memory.dmp

Filesize
6.6MB

Download
memory/3612-138-0x0000000000170000-0x00000000007FD000-memory.dmp

Filesize
6.6MB

Download
memory/3612-140-0x0000000000170000-0x00000000007FD000-memory.dmp

Filesize
6.6MB

Download
memory/3704-139-0x0000000000000000-mapping.dmp

Download