a2cd8cd6217b4db468f8cd5333ed2f01275267843c7918ad05eeda05119a8747

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 02:15

Target

c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
Size

241KB
MD5

cd46b53882d04f2315c904c557d8a103
SHA1

c336fd4054a639dda2b2d073e93478d7bbd30867
SHA256

c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add
SHA512

b50c95169f2896615eb6bcbba511ee351cfe959e5b47896074b14d8d831476888df57344f0cd6e302b7b70fc5d07ccf785c53ad79a474876b1899c7012fa43e6
SSDEEP

6144:39KSV7GYsKltwhdPTJ6l0uLo5P/Icf0ah9RNdNT:tKSBG5K7wPTmI53Icf0ahn/B

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2036-54-0x000000013F640000-0x000000013F6C6000-memory.dmp	vmprotect
behavioral1/memory/2036-56-0x000000013F640000-0x000000013F6C6000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 2036 WerFault.exe c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe

pid	pid_target	process	target process
2044	2036	WerFault.exe	c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe

description	pid	process	target process
PID 2036 wrote to memory of 2044	2036	c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe	WerFault.exe
PID 2036 wrote to memory of 2044	2036	c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe	WerFault.exe
PID 2036 wrote to memory of 2044	2036	c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
"C:\Users\Admin\AppData\Local\Temp\c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 68
  2⤵
  - Program crash
  PID:2044

memory/2036-54-0x000000013F640000-0x000000013F6C6000-memory.dmp

Filesize
536KB

Download
memory/2036-56-0x000000013F640000-0x000000013F6C6000-memory.dmp

Filesize
536KB

Download