d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 08:42 UTC

Target

d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe
Size

2.4MB
MD5

558cd7f89fcc7ba19b00837db0750ec5
SHA1

f32fc85be8a06123fbf99471192e346226652955
SHA256

d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26
SHA512

58d2e4df955cea93dfec0a62eda4141f9cd37edbe41b95787074b201d0c2c25a546de6a1e9117aac08761d7e43d15d26bc56ed539bd1b1297142b919d4ef9c73
SSDEEP

49152:iEYLYy7zyVyYalRIhDsSv0iOU8HCKEzo5ARwCgci3WrxAf29oe56We:ILlIDXHzouT/iG1AfIu

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2192-0-0x000000013F0E0000-0x000000013F340000-memory.dmp	vmprotect
behavioral1/memory/2192-1-0x000000013F0E0000-0x000000013F340000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3060	2192	d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe	28
PID 2192 wrote to memory of 3060	2192	d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe	28
PID 2192 wrote to memory of 3060	2192	d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe	28

C:\Users\Admin\AppData\Local\Temp\d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe
"C:\Users\Admin\AppData\Local\Temp\d037c5c04dbb1010ea782a1e7bc89eb112f9c976a1079e10d06b04d639fe9b26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 64
  2⤵
  PID:3060

memory/2192-0-0x000000013F0E0000-0x000000013F340000-memory.dmp

Filesize
2.4MB

Download
memory/2192-1-0x000000013F0E0000-0x000000013F340000-memory.dmp

Filesize
2.4MB

Download