fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0

Analysis

max time kernel
162s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 22:16

Target

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
Size

907KB
MD5

3a2b63625c8862931ea83ff11b5abdcf
SHA1

a5c02926be0c3bbc7de38094e15b6016f44b9db0
SHA256

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0
SHA512

bddf58ca57f103d79ab2cf7a86f62557e941cfb82889a5c6b4c6bf7ead835b74f633287ba8fe6ac65d36a6b36dbf1213d1c46bf21b5bb376d758afe309ca33c7
SSDEEP

24576:IlHxz7GCocgyvVZVYkt94P3LXb7WsT2Zmz:yRW6gyrGB3jvWsT2Zk

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4620-132-0x00000000000D0000-0x0000000000282000-memory.dmp	vmprotect
behavioral2/memory/4620-133-0x00000000000D0000-0x0000000000282000-memory.dmp	vmprotect
behavioral2/memory/4620-135-0x00000000000D0000-0x0000000000282000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1860 4620 WerFault.exe fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

pid	pid_target	process	target process
1860	4620	WerFault.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
"C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe"
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 468
2⤵
- Program crash
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4620 -ip 4620
1⤵
PID:2220

memory/4620-132-0x00000000000D0000-0x0000000000282000-memory.dmp

Filesize
1.7MB

Download
memory/4620-133-0x00000000000D0000-0x0000000000282000-memory.dmp

Filesize
1.7MB

Download
memory/4620-134-0x0000000002330000-0x00000000023E6000-memory.dmp

Filesize
728KB

Download
memory/4620-135-0x00000000000D0000-0x0000000000282000-memory.dmp

Filesize
1.7MB

Download
memory/4620-136-0x0000000002330000-0x00000000023E6000-memory.dmp

Filesize
728KB

Download