c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:57

Target

c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471.exe
Size

740KB
MD5

3f39f1f35b54b6e0e7e59d1b5566c7ea
SHA1

1c41b622ae76f061f81c663452a3dc5b5b6c80ca
SHA256

c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471
SHA512

9e1ee37657f2af1294bdb5173fab436c9af9c16612d85d0e5c1472b9a19abd7ff1d04503f85a270fb778c7b247a8e54a4bd46a97a5950b82e0e5c16a7e476f94
SSDEEP

12288:rEiSXrLbZWyeUY2DGnLXMbX7pokaGh6neyFLdFg3LdF2uNpc:8/DGLXMWkL6nldFg7CuNp

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/864-55-0x0000000000400000-0x00000000005DF000-memory.dmp	vmprotect
behavioral1/memory/864-58-0x0000000000400000-0x00000000005DF000-memory.dmp	vmprotect
behavioral1/memory/864-59-0x0000000000400000-0x00000000005DF000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
864	c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471.exe
864	c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471.exe

C:\Users\Admin\AppData\Local\Temp\c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471.exe
"C:\Users\Admin\AppData\Local\Temp\c107444e20c27cc6bfbbec5a1b08d71a2a8fd64bbec9b3d2691a2e9237188471.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:864

memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/864-55-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/864-58-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/864-59-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download