049cd9c4000ae59133dc94683891e83f48cb427d34552b4da2a4de0b0970a7f4 | Triage

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 15:20

Sharing

Report Analysis Logs

General

Target

2c5c54a990db2104a219a432fa6c9ddf.exe
Size

3.5MB
MD5

2c5c54a990db2104a219a432fa6c9ddf
SHA1

166666bb57bb069f7b8a783000d373d70510aebf
SHA256

049cd9c4000ae59133dc94683891e83f48cb427d34552b4da2a4de0b0970a7f4
SHA512

1c376cb71a9315bc9361b595a455292ca0cea652c385e67a430f02cf42d1d8950b40862c8060af89152306c4982b445c535d34f50af7fdadf80541e109b8b445
SSDEEP

98304:ocio410Wzmizg68hmsbx1YyqfaU3nuJwylWu:niBslhmsbx1fqQKy

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2036-54-0x0000000140000000-0x0000000140616000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1172	2036	2c5c54a990db2104a219a432fa6c9ddf.exe	28
PID 2036 wrote to memory of 1172	2036	2c5c54a990db2104a219a432fa6c9ddf.exe	28
PID 2036 wrote to memory of 1172	2036	2c5c54a990db2104a219a432fa6c9ddf.exe	28

C:\Users\Admin\AppData\Local\Temp\2c5c54a990db2104a219a432fa6c9ddf.exe
"C:\Users\Admin\AppData\Local\Temp\2c5c54a990db2104a219a432fa6c9ddf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 56
  2⤵
  - Program crash
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000140000000-0x0000000140616000-memory.dmp

Filesize
6.1MB

Download