778ee9eed18d79a8344aeaa35726075c889bb391599977ee9787162465e23c4a

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 02:38

Target

疯狂神器2014-终极版.exe
Size

17.0MB
MD5

499936e83f5bb80424439f40684a35ce
SHA1

4edc7a2d493270c6fb82b9aeb7504b59d8ab2996
SHA256

4a591f9699af60ad1fdf47817ef11cbd01a4da1307e076358ec94335867d441f
SHA512

6b5c8532701729eb1242642fb8819f3cfcb105e2dd27d5f8c7654afca952ce9ff58db9badf76ec514ad01d426a55c002f34237d6e6b9c9acb06cecc6348a383c
SSDEEP

196608:EX5kL227Kf97ZY2XnAF4EEqkvxLrqGns07QNSREQces8+JHnxXCjyE9Mee6ChJ1T:E5QVWXKCvxLrqGniVQ2XOevxt7rX7

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3112-132-0x0000000000400000-0x0000000002880000-memory.dmp	vmprotect
behavioral2/memory/3112-133-0x0000000000400000-0x0000000002880000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1044 3112 WerFault.exe 疯狂神器2014-终极版.exe

pid	pid_target	process	target process
1044	3112	WerFault.exe	疯狂神器2014-终极版.exe

C:\Users\Admin\AppData\Local\Temp\疯狂神器2014-终极版.exe
"C:\Users\Admin\AppData\Local\Temp\疯狂神器2014-终极版.exe"
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 552
2⤵
- Program crash
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3112 -ip 3112
1⤵
PID:1848

memory/3112-132-0x0000000000400000-0x0000000002880000-memory.dmp

Filesize
36.5MB

Download
memory/3112-133-0x0000000000400000-0x0000000002880000-memory.dmp

Filesize
36.5MB

Download