1c307877b29bfa741b365fa9a05373160ad5bf98608de2a847a4b8231174d1de

Analysis

max time kernel
48s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:29

Target

qq_post.exe
Size

1.1MB
MD5

2c2bbff1623e1bd5e6b95238b5ec414f
SHA1

23bd5122c3d3f08e964ed93320884d84ecdb51ae
SHA256

5bffd08245765c4d876206118abfd46b7936a42feeecb30e39ae39f643f4fba1
SHA512

f9997f610ab760b3785f18efb04726ca1f496a14fd59c0f1b9b507fb3015d3e5b24c12f1f8071d254fe0ab69392452b8dfed0643452270eb3636ab1625f0dbda
SSDEEP

12288:n4WXqVFRvFY4VfReChGGejOlqKD2yWLX7OImIlphyZCskWX2cujU:n4W6VFWlIX5uj

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral23/memory/1992-55-0x0000000010000000-0x0000000010255000-memory.dmp	vmprotect
behavioral23/memory/1992-58-0x0000000010000000-0x0000000010255000-memory.dmp	vmprotect
behavioral23/memory/1992-62-0x0000000010000000-0x0000000010255000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

qq_post.exe

description	pid	process	target process
PID 1992 wrote to memory of 1900	1992	qq_post.exe	dw20.exe
PID 1992 wrote to memory of 1900	1992	qq_post.exe	dw20.exe
PID 1992 wrote to memory of 1900	1992	qq_post.exe	dw20.exe
PID 1992 wrote to memory of 1900	1992	qq_post.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\qq_post.exe
"C:\Users\Admin\AppData\Local\Temp\qq_post.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 652
2⤵
PID:1900

memory/1900-59-0x0000000000000000-mapping.dmp

Download
memory/1992-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000010000000-0x0000000010255000-memory.dmp

Filesize
2.3MB

Download
memory/1992-57-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-58-0x0000000010000000-0x0000000010255000-memory.dmp

Filesize
2.3MB

Download
memory/1992-61-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-62-0x0000000010000000-0x0000000010255000-memory.dmp

Filesize
2.3MB

Download