f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 10:26

Target

f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
Size

11.3MB
MD5

b10b39ce6a1fa7f8a743d94fdda462a6
SHA1

9f090ed56f6a63cd43d05f6a6b51322bb061cd07
SHA256

f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180
SHA512

68dd4dbf0c4b0dd22dfd3869aad267870fec1d47c119880ccdcc52b8ec05918032225b023d42df59b49ccb1d63a23e388ce93eb137e461ab89bb529cb76e9cb6
SSDEEP

196608:m8pXjCw2Tx2iqzBvo8uOUhKMAXoVqoz2uQmKVmuSUVarET/D0BjQsVN6cyOqWlRp:VzCw2TYiqz8OEKPoVBhFolVb/D0DVBzD

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/116-3-0x0000000000400000-0x0000000001C26000-memory.dmp	vmprotect
behavioral2/memory/116-8-0x0000000000400000-0x0000000001C26000-memory.dmp	vmprotect
behavioral2/memory/116-12-0x0000000000400000-0x0000000001C26000-memory.dmp	vmprotect

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1552	116	WerFault.exe	84
5068	116	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3520	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
116	f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe

C:\Users\Admin\AppData\Local\Temp\f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe
"C:\Users\Admin\AppData\Local\Temp\f9cd5a7d61db6f376cae68ebd5802ca2be0a9160a90f31dd3b33eaef45968180.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 948
  2⤵
  - Program crash
  PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 948
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 116 -ip 116
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 116 -ip 116
1⤵
PID:5076

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520

memory/116-0-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/116-1-0x0000000001E00000-0x0000000001E01000-memory.dmp

Filesize
4KB

Download
memory/116-2-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/116-3-0x0000000000400000-0x0000000001C26000-memory.dmp

Filesize
24.1MB

Download
memory/116-4-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/116-5-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/116-6-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/116-8-0x0000000000400000-0x0000000001C26000-memory.dmp

Filesize
24.1MB

Download
memory/116-12-0x0000000000400000-0x0000000001C26000-memory.dmp

Filesize
24.1MB

Download
memory/3520-13-0x00000188DCD40000-0x00000188DCD50000-memory.dmp

Filesize
64KB

Download
memory/3520-29-0x00000188DCE40000-0x00000188DCE50000-memory.dmp

Filesize
64KB

Download
memory/3520-45-0x00000188E5190000-0x00000188E5191000-memory.dmp

Filesize
4KB

Download
memory/3520-47-0x00000188E51C0000-0x00000188E51C1000-memory.dmp

Filesize
4KB

Download
memory/3520-48-0x00000188E51C0000-0x00000188E51C1000-memory.dmp

Filesize
4KB

Download
memory/3520-49-0x00000188E52D0000-0x00000188E52D1000-memory.dmp

Filesize
4KB

Download