91b5dd1d3b3389471526471e7bbd23f70c9a94ce73733e21b8c7f99a6b3a6d1d

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 13:52

Target

file.exe
Size

3.5MB
MD5

6a132fec0229a82f641efd9f2b489348
SHA1

e54f7f270f155e813adcb1adbbd8b0d310c790d5
SHA256

91b5dd1d3b3389471526471e7bbd23f70c9a94ce73733e21b8c7f99a6b3a6d1d
SHA512

428438a50d4d937e5e4cb0118882c1ad8c979ee838a8220c4e2f74ed902113478f75c1c1c1db8702f3cb76c88a9cdc08bda40670d15b62d37b7fd4efe282045c
SSDEEP

49152:dJTO65WNj2rPLwdimBGEFcGvC+ox09wQ3sx9axS/k+XQlPWR9KuaDCXq1j9aRL2W:/S6rUgQBcVlcwQcxsxScS/TQYCIplP

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/832-54-0x0000000140000000-0x000000014061B000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	832	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1200	832	file.exe	28
PID 832 wrote to memory of 1200	832	file.exe	28
PID 832 wrote to memory of 1200	832	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 832 -s 56
  2⤵
  - Program crash
  PID:1200

memory/832-54-0x0000000140000000-0x000000014061B000-memory.dmp

Filesize
6.1MB

Download