Analysis
-
max time kernel
90s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
26-11-2022 06:05
General
-
Target
三国魂战魂/update.exe
-
Size
1.3MB
-
MD5
5555945c3f82b5db004034aecc956414
-
SHA1
a39ab33ade7345156a63848bb520c254b2fce48c
-
SHA256
43094d5d7d6335e32eaecc3a90dabe0ee627a61bf0cc840e82e2a007ce9b9652
-
SHA512
632721a2ceee73dce0fca0ff2ec5033b3d9bd2c4157f85ade344125e07ba561708aa5fd266dec96349353f680e8c52dc93f3d673820ef41024c99f4d19e3017a
-
SSDEEP
24576:yWdd5mgZjweiCgeSzbVEOWrzB5AI5DhK3IDj1aDykEbkZvWez5AWZzqQYntkXta8:Bdd5mgZwrbeSzREOWZB5Dkaj1aDy4tH5
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\三国魂战魂\update.exe"C:\Users\Admin\AppData\Local\Temp\三国魂战魂\update.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3252-132-0x0000000000400000-0x00000000006D6000-memory.dmpFilesize
2.8MB
-
memory/3252-133-0x0000000000400000-0x00000000006D6000-memory.dmpFilesize
2.8MB
-
memory/3252-135-0x0000000000400000-0x00000000006D6000-memory.dmpFilesize
2.8MB