a2cd8cd6217b4db468f8cd5333ed2f01275267843c7918ad05eeda05119a8747

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 02:15

Target

c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
Size

241KB
MD5

cd46b53882d04f2315c904c557d8a103
SHA1

c336fd4054a639dda2b2d073e93478d7bbd30867
SHA256

c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add
SHA512

b50c95169f2896615eb6bcbba511ee351cfe959e5b47896074b14d8d831476888df57344f0cd6e302b7b70fc5d07ccf785c53ad79a474876b1899c7012fa43e6
SSDEEP

6144:39KSV7GYsKltwhdPTJ6l0uLo5P/Icf0ah9RNdNT:tKSBG5K7wPTmI53Icf0ahn/B

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/620-133-0x00007FF7789B0000-0x00007FF778A36000-memory.dmp	vmprotect
behavioral2/memory/620-135-0x00007FF7789B0000-0x00007FF778A36000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 620 WerFault.exe c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe

pid	pid_target	process	target process
1384	620	WerFault.exe	c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe

C:\Users\Admin\AppData\Local\Temp\c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
"C:\Users\Admin\AppData\Local\Temp\c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe"
1⤵
PID:620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 620 -s 216
2⤵
- Program crash
PID:1384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 620 -ip 620
1⤵
PID:3760

memory/620-133-0x00007FF7789B0000-0x00007FF778A36000-memory.dmp

Filesize
536KB

Download
memory/620-135-0x00007FF7789B0000-0x00007FF778A36000-memory.dmp

Filesize
536KB

Download