a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/极限处理器.exe
Size

4.1MB
MD5

4707f303bf7416fdb58e2ae62e64714c
SHA1

1645325a57bd9a4b92aceae98661dc2a6d9d9293
SHA256

db9f698360d7ca795075fbbaf62b60dea53cb060d6b7640c8dfc268b18bf8af3
SHA512

76f65af2918685ccdbb2f7bbb83c0f9ab3abfbc927a94b2a52ebac9fd54de54cec5b95bc4294d89b2756c7c05f9263a0c077d4b302bd0b1e4f3616cfcbd92ce4
SSDEEP

98304:tJkE1sb/ywRW3p5O1OJa3BVuFsCxlejnlXOXiw3oDl3Yqw:THWR8/UOaMlxgDNOOF

Score

8^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral30/memory/1800-132-0x0000000000400000-0x000000000083A000-memory.dmp	vmprotect
behavioral30/memory/1800-133-0x0000000000400000-0x000000000083A000-memory.dmp	vmprotect
behavioral30/memory/1800-134-0x0000000000400000-0x000000000083A000-memory.dmp	vmprotect
behavioral30/memory/1800-135-0x0000000000400000-0x000000000083A000-memory.dmp	vmprotect

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3336 1800 WerFault.exe 极限处理器.exe
1880 1800 WerFault.exe 极限处理器.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

极限处理器.exe

pid process

1800 极限处理器.exe
1800 极限处理器.exe

pid	pid_target	process	target process
3336	1800	WerFault.exe	极限处理器.exe
1880	1800	WerFault.exe	极限处理器.exe

pid	process
1800	极限处理器.exe
1800	极限处理器.exe

C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\极限处理器.exe
"C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\极限处理器.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 680
2⤵
- Program crash
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 680
2⤵
- Program crash
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1800 -ip 1800
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1800 -ip 1800
1⤵
PID:2024

memory/1800-132-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/1800-133-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/1800-134-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/1800-135-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download