717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7

Analysis

max time kernel
234s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 12:15

Target

717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe
Size

2.6MB
MD5

ca7cf32dd32a65e4dbc25584ae029685
SHA1

280265d868d6b338099e654cbab760671cc026f7
SHA256

717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7
SHA512

a40c9b360bd2a553cbd46aecb8d0190d1c8ee4b84447d9edef13c1434039c2a243b084299265891c98b3e812aa82d873915b6d479e512a80ea8a0adc4cb16b6d
SSDEEP

49152:4r6hR1Rj047aIty01VklkCtLg8qtCM8GNTreswSfLdsbU:4r0R1a47Hty01Vklkks/dXwqp

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1712-55-0x0000000000400000-0x0000000000989000-memory.dmp	vmprotect
behavioral1/memory/1712-56-0x0000000000400000-0x0000000000989000-memory.dmp	vmprotect
behavioral1/memory/1712-60-0x0000000000400000-0x0000000000989000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	1712	WerFault.exe	27

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe
1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1592	1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe	28
PID 1712 wrote to memory of 1592	1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe	28
PID 1712 wrote to memory of 1592	1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe	28
PID 1712 wrote to memory of 1592	1712	717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe	28

C:\Users\Admin\AppData\Local\Temp\717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe
"C:\Users\Admin\AppData\Local\Temp\717d7336f3a120865955c8792004d53779b73cdadefa635d9918a3b72ba694a7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 268
  2⤵
  - Program crash
  PID:1592

memory/1712-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000000400000-0x0000000000989000-memory.dmp

Filesize
5.5MB

Download
memory/1712-56-0x0000000000400000-0x0000000000989000-memory.dmp

Filesize
5.5MB

Download
memory/1712-60-0x0000000000400000-0x0000000000989000-memory.dmp

Filesize
5.5MB

Download