7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 10:03

Target

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
Size

3.5MB
MD5

8a470899a6ebb2299b54da55ad3897d2
SHA1

1ebafddb262fe912641e260fcf407907ca67fb74
SHA256

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313
SHA512

dde4489c467d232c5b8e7930ff0991c33aa1477666984bf69559556229b5a76951015fe38993d7289acb5aa5e9661126ed1ac9878cf44a4fbf9b06e57e1275b4
SSDEEP

49152:SMQyNFL4gSeOzD5rbhdU7bSVziW+Gz/6Sq5ms7Otvx2mAmMm0pFZMpTBkRdFFU2:NL4B35rbhCkiStvx2GcFZM1BOU

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2044-54-0x0000000001090000-0x000000000140E000-memory.dmp	vmprotect

Kills process with taskkill 1 IoCs

evasion

pid	Process
2984	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe
Token: SeDebugPrivilege	2984	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2836	2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	28
PID 2044 wrote to memory of 2836	2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	28
PID 2044 wrote to memory of 2836	2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	28
PID 2044 wrote to memory of 2836	2044	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313exe_JC.exe	28
PID 2836 wrote to memory of 2984	2836	cmd.exe	30
PID 2836 wrote to memory of 2984	2836	cmd.exe	30
PID 2836 wrote to memory of 2984	2836	cmd.exe	30
PID 2836 wrote to memory of 2984	2836	cmd.exe	30

memory/2044-54-0x0000000001090000-0x000000000140E000-memory.dmp

Filesize
3.5MB

Download
memory/2044-55-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-56-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-57-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-59-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-58-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2044-60-0x00000000052E0000-0x0000000005436000-memory.dmp

Filesize
1.3MB

Download
memory/2044-61-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-62-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-63-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-64-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-65-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-66-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-67-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-68-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/2044-71-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download