4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1

Analysis

max time kernel
112s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 13:41

Target

4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe
Size

313KB
MD5

9bf959cb9e472c1598e1cb983992cc8b
SHA1

5eea609833044dd334fe54919a0ea36e77ee782f
SHA256

4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1
SHA512

2b87e8a34b1c874ed3448677cab8ce3fa0fcbadec82bf8ce050c0b15be117e7aade78a01527d1bf5f3130b5fedf7e0fe3d564e2ca3f16525f560e2f76ce0db83
SSDEEP

6144:bB/l0Xi3uyJ7Mhy9dx3s3fZbCTxagKzW683zO1rv1vW2uqzC:l/OXIuCWOuRCTx9Kz83SL1eYW

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4864-132-0x0000000000C40000-0x0000000000C88000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2444 4864 WerFault.exe 4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe

pid	pid_target	process	target process
2444	4864	WerFault.exe	4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe

C:\Users\Admin\AppData\Local\Temp\4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe
"C:\Users\Admin\AppData\Local\Temp\4a5c286d200a2f50dcf2b66517b442aa3a0a95cdaa7b91cf3f30c1bfc9c3ddd1.exe"
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 444
2⤵
- Program crash
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4864 -ip 4864
1⤵
PID:3268

memory/4864-132-0x0000000000C40000-0x0000000000C88000-memory.dmp

Filesize
288KB

Download