Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3VMProtect....K32.so
ubuntu-18.04-amd64
1VMProtect....K64.so
ubuntu-18.04-amd64
1VMProtect.....dylib
macos-10.15-amd64
1VMProtect....DK.dll
windows7-x64
1VMProtect....DK.dll
windows10-2004-x64
1VMProtect....32.dll
windows7-x64
1VMProtect....32.dll
windows10-2004-x64
1VMProtect....64.dll
windows7-x64
1VMProtect....64.dll
windows10-2004-x64
1VMProtect....32.dll
windows7-x64
1VMProtect....32.dll
windows10-2004-x64
3VMProtect....64.dll
windows7-x64
1VMProtect....64.dll
windows10-2004-x64
1VMProtect....ct.exe
windows7-x64
5VMProtect....ct.exe
windows10-2004-x64
5VMProtect....on.exe
windows7-x64
5VMProtect....on.exe
windows10-2004-x64
5VMProtect....00.exe
windows7-x64
7VMProtect....00.exe
windows10-2004-x64
7Analysis
-
max time kernel
146s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Linux/libVMProtectSDK32.so
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral2
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Linux/libVMProtectSDK64.so
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral3
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/OSX/libVMProtectSDK.dylib
Resource
macos-20220504-en
Behavioral task
behavioral4
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/Net/VMProtect.SDK.dll
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/Net/VMProtect.SDK.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectDDK32.dll
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectDDK32.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectDDK64.dll
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectDDK64.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK32.dll
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK32.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK64.dll
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectSDK64.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/VMProtect.exe
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/VMProtect.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/VMProtect_Con.exe
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/VMProtect_Con.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/unins000.exe
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
VMProtect.Ultimate.v3.6.0.1416-Cracked/unins000.exe
Resource
win10v2004-20230915-en
General
-
Target
VMProtect.Ultimate.v3.6.0.1416-Cracked/Lib/Windows/VMProtectDDK32.dll
-
Size
3KB
-
MD5
5a26bae061acaebd29debdaa63f679b4
-
SHA1
d53b3afa50f954c7c6dfae2184061c3f040841fd
-
SHA256
3fbe00725014e82256e545168b26d99106d5bff5520822aaed5adf7f001d3cde
-
SHA512
d36683293aaee9879260085297808e5956e6d2fa2abd70165ca1de7a5fd16bee484b8a6af10bf307addb54e0e3d01d5ecd7f559181fa8aee040c20f54fc6217e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4688 4520 rundll32.exe 87 PID 4520 wrote to memory of 4688 4520 rundll32.exe 87 PID 4520 wrote to memory of 4688 4520 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectDDK32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VMProtect.Ultimate.v3.6.0.1416-Cracked\Lib\Windows\VMProtectDDK32.dll,#12⤵PID:4688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4688 -ip 46881⤵PID:1580