Analysis
-
max time kernel
43s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
25-11-2022 21:22
General
-
Target
傳奇守護者免费版1.8.9/传奇通用变速器4.0.exe
-
Size
895KB
-
MD5
fa41210502101fcdcd0c3d66bb95d619
-
SHA1
4d7afa6833559eafffb87da83c835c8d496a213b
-
SHA256
537ca1477d99b50ffa5485d19646156eb8c694aa6e1e5c94f56cc206d653b4ec
-
SHA512
729584dab79a2ea84e697a75e880460de696d0e4161f6ebf1527ac027ae3a2636c5ab15df7039ce19cb1aecb759804cc976770eb0da45c5676b087ba27111d6b
-
SSDEEP
24576:pVsEWC4PwIMApdC2QIZZU3JhZw4VQeDZW:3TYP3MhPIqfakN
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\传奇通用变速器4.0.exe"C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\传奇通用变速器4.0.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-54-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1288-55-0x0000000000400000-0x00000000005C9000-memory.dmpFilesize
1.8MB
-
memory/1288-57-0x0000000000400000-0x00000000005C9000-memory.dmpFilesize
1.8MB
-
memory/1288-58-0x0000000000400000-0x00000000005C9000-memory.dmpFilesize
1.8MB