1097d1bce312d4f00a9625f4edd7a9d558ee5351a6574fa3394ee9e2a66d7956

Analysis

max time kernel
78s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:50

Target

5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe
Size

4.6MB
MD5

abf8ce24084059625e02328dbc72e1c7
SHA1

5d98299177c4b55572d96dfb1b93e141c9de9c2e
SHA256

5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2
SHA512

5f6eed58cf70c583e48d101919f8f4803dcb8c02193bcd5b6bc0ed731ebff5c0876323d44fd4bad0ae81b4e37f5897f6595878210efb5fff9245762a68a44179
SSDEEP

98304:D8ZNWuqWiSagBBKI82NGSvagu0FcV2U1LBri2224SaCos8jr0GUgh10uiV9tWLhj:DCqWieBKI82N1K0SV2U9BOX24S0s8H0M

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1760-56-0x0000000000900000-0x000000000101D000-memory.dmp	vmprotect
behavioral1/memory/1760-55-0x0000000000900000-0x000000000101D000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe

pid process

1760 5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe

pid	process
1760	5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe

C:\Users\Admin\AppData\Local\Temp\5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe
"C:\Users\Admin\AppData\Local\Temp\5e3b5dfb1324cecfae22728323ca804e8f46b949b86998fc32ca5a16e31c45b2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760

memory/1760-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1760-56-0x0000000000900000-0x000000000101D000-memory.dmp

Filesize
7.1MB

Download
memory/1760-55-0x0000000000900000-0x000000000101D000-memory.dmp

Filesize
7.1MB

Download