adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 11:22

Target

adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe
Size

3.5MB
MD5

df21f5ad40255a79d5b308c45346fc18
SHA1

4493b39a526899d4f38ff2cb847c5e2eab4b5d64
SHA256

adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda
SHA512

4a0788dd71359f3d947c21320fdbf2575dc2457c946ac692a33dad5719a0ad4598f8af5cd8b59c1635d9b9b7917f55797050dd06c3e3f7883a5858fa05fd6693
SSDEEP

49152:eUeRff2eGxrSEj/sSfFXOq1U2MU90FDO9k7oVYs00o6CaEZfytGO2PagJ7gGHejX:evuXWKNRh1X0K9k0VYs0rASwe9+j0wn

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1492-54-0x0000000140000000-0x0000000140618000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	1492	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1640	1492	adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe	28
PID 1492 wrote to memory of 1640	1492	adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe	28
PID 1492 wrote to memory of 1640	1492	adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe	28

C:\Users\Admin\AppData\Local\Temp\adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe
"C:\Users\Admin\AppData\Local\Temp\adc91b86359875df0149a283a6dbf6c11a9d6e4fd494c1340f20b3324571bdda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 56
  2⤵
  - Program crash
  PID:1640

memory/1492-54-0x0000000140000000-0x0000000140618000-memory.dmp

Filesize
6.1MB

Download