ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 04:06

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c.exe command="C:\Users\Admin\AppData\Local\Temp\ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c.exe
Size

742KB
MD5

08063f434e437e5869b63854aa8a9350
SHA1

5171b39ef36a4aa677905bbd0ffb8784e3be4a54
SHA256

ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c
SHA512

860ed3b22da57164042c7aedd9e392ce2739eee6926166dc60b5534633d3923900f68de345ffd1df0f0f57075a426a63676d91fce0d036914ce97e83f57be4c6
SSDEEP

12288:DS//2o3jya9lckOQoPy8yGyG7e6qrh5pEfEDNsO18R6XC6LHYShxzG635Yq:DSNma9PAyGVE7pEfCOcVHhxa4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1640-54-0x0000000000010000-0x0000000000172000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c.exe
"C:\Users\Admin\AppData\Local\Temp\ef3261bfadd6b8a6b65ed882633d6a44406ede882e20a14d2122645821a5d23c.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-54-0x0000000000010000-0x0000000000172000-memory.dmp

Filesize
1.4MB

Download