f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 10:26

Target

f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
Size

11.3MB
MD5

b10b39ce6a1fa7f8a743d94fdda462a6
SHA1

9f090ed56f6a63cd43d05f6a6b51322bb061cd07
SHA256

f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180
SHA512

68dd4dbf0c4b0dd22dfd3869aad267870fec1d47c119880ccdcc52b8ec05918032225b023d42df59b49ccb1d63a23e388ce93eb137e461ab89bb529cb76e9cb6
SSDEEP

196608:m8pXjCw2Tx2iqzBvo8uOUhKMAXoVqoz2uQmKVmuSUVarET/D0BjQsVN6cyOqWlRp:VzCw2TYiqz8OEKPoVBhFolVb/D0DVBzD

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2112-5-0x0000000000400000-0x0000000001C26000-memory.dmp	vmprotect
behavioral1/memory/2112-35-0x0000000000400000-0x0000000001C26000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2112	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2792	2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe	28
PID 2112 wrote to memory of 2792	2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe	28
PID 2112 wrote to memory of 2792	2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe	28
PID 2112 wrote to memory of 2792	2112	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe	28

C:\Users\Admin\AppData\Local\Temp\f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
"C:\Users\Admin\AppData\Local\Temp\f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 364
  2⤵
  - Program crash
  PID:2792

memory/2112-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2112-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2112-5-0x0000000000400000-0x0000000001C26000-memory.dmp

Filesize
24.1MB

Download
memory/2112-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2112-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2112-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2112-10-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2112-13-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2112-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2112-18-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2112-20-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2112-23-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2112-25-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2112-28-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2112-30-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2112-35-0x0000000000400000-0x0000000001C26000-memory.dmp

Filesize
24.1MB

Download