6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47

Analysis

max time kernel
232s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:15

Target

6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe
Size

361KB
MD5

a1b018a89c0413472bab8a4b4e6d4f21
SHA1

df02e3f25461e9d8741ff41c2365fc79188ffd82
SHA256

6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47
SHA512

8e4968497b2f9ec0d6969ed3445fa3319baa6d833613e4013e60a79a6eb79315780f629f0a49948036ce19b5021d6c38fff848bba5d2b518f5b3f92c5d5aaf78
SSDEEP

6144:VC6GdZJ7Rt6+5J/vhqQ1TBlzwXkNp2WmRF/PJlxzleVVB7H1izUZ:06GDVhqADsXAsflzeVVDioZ

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/668-55-0x0000000000400000-0x0000000000506000-memory.dmp	vmprotect
behavioral1/memory/668-57-0x0000000000400000-0x0000000000506000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe

pid process

668 6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe

pid	process
668	6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe

C:\Users\Admin\AppData\Local\Temp\6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe
"C:\Users\Admin\AppData\Local\Temp\6708435bf3f114ec6ccbef93fd9a748f8f782a5905ee6131e0fa157e40f5bb47.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:668

memory/668-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/668-55-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/668-57-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download