4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1

Analysis

max time kernel
41s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 13:41

Target

4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe
Size

313KB
MD5

9bf959cb9e472c1598e1cb983992cc8b
SHA1

5eea609833044dd334fe54919a0ea36e77ee782f
SHA256

4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1
SHA512

2b87e8a34b1c874ed3448677cab8ce3fa0fcbadec82bf8ce050c0b15be117e7aade78a01527d1bf5f3130b5fedf7e0fe3d564e2ca3f16525f560e2f76ce0db83
SSDEEP

6144:bB/l0Xi3uyJ7Mhy9dx3s3fZbCTxagKzW683zO1rv1vW2uqzC:l/OXIuCWOuRCTx9Kz83SL1eYW

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1216-55-0x00000000012D0000-0x0000000001318000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 1216 WerFault.exe 4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe

pid	pid_target	process	target process
1256	1216	WerFault.exe	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe

description	pid	process	target process
PID 1216 wrote to memory of 1256	1216	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe	WerFault.exe
PID 1216 wrote to memory of 1256	1216	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe	WerFault.exe
PID 1216 wrote to memory of 1256	1216	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe	WerFault.exe
PID 1216 wrote to memory of 1256	1216	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe
"C:\Users\Admin\AppData\Local\Temp\4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 132
2⤵
- Program crash
PID:1256

memory/1216-55-0x00000000012D0000-0x0000000001318000-memory.dmp

Filesize
288KB

Download
memory/1256-54-0x0000000000000000-mapping.dmp

Download