adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda

Analysis

max time kernel
47s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 08:32

Target

file.exe
Size

3.5MB
MD5

df21f5ad40255a79d5b308c45346fc18
SHA1

4493b39a526899d4f38ff2cb847c5e2eab4b5d64
SHA256

adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda
SHA512

4a0788dd71359f3d947c21320fdbf2575dc2457c946ac692a33dad5719a0ad4598f8af5cd8b59c1635d9b9b7917f55797050dd06c3e3f7883a5858fa05fd6693
SSDEEP

49152:eUeRff2eGxrSEj/sSfFXOq1U2MU90FDO9k7oVYs00o6CaEZfytGO2PagJ7gGHejX:evuXWKNRh1X0K9k0VYs0rASwe9+j0wn

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/592-54-0x0000000140000000-0x0000000140618000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1412 592 WerFault.exe file.exe

pid	pid_target	process	target process
1412	592	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

file.exe

description	pid	process	target process
PID 592 wrote to memory of 1412	592	file.exe	WerFault.exe
PID 592 wrote to memory of 1412	592	file.exe	WerFault.exe
PID 592 wrote to memory of 1412	592	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 592 -s 56
2⤵
- Program crash
PID:1412

memory/592-54-0x0000000140000000-0x0000000140618000-memory.dmp

Filesize
6.1MB

Download
memory/1412-58-0x0000000000000000-mapping.dmp

Download