e3659da813f9622f97097552d6b3dd07d3f41ac617fae11891a778d1c2e353d2

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 14:46

Target

4bb715d31ae6263d2e0d9fb1e02c9c2c.exe
Size

124KB
MD5

4bb715d31ae6263d2e0d9fb1e02c9c2c
SHA1

4683c64ae26a22b27aac738f4e885455d0373758
SHA256

e3659da813f9622f97097552d6b3dd07d3f41ac617fae11891a778d1c2e353d2
SHA512

09975e8db5efe7a72162c3184b83105983801ab09fe33edda563d9e992dd0ba47bee844ba2ad008c01f53c2d963afcdbc03e762a9a56c11af1b06e6c87e9b332
SSDEEP

3072:/qqb/uqHdxO6gQqPfBWRyVttYr+rcSfrLG:/HbmqHd8ZQKfB6yxiujzLG

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2180-0-0x0000000000400000-0x0000000000432000-memory.dmp	vmprotect
behavioral1/memory/2180-1-0x0000000000400000-0x0000000000432000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2180	4bb715d31ae6263d2e0d9fb1e02c9c2c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2180	WerFault.exe	26

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2676	2180	4bb715d31ae6263d2e0d9fb1e02c9c2c.exe	29
PID 2180 wrote to memory of 2676	2180	4bb715d31ae6263d2e0d9fb1e02c9c2c.exe	29
PID 2180 wrote to memory of 2676	2180	4bb715d31ae6263d2e0d9fb1e02c9c2c.exe	29
PID 2180 wrote to memory of 2676	2180	4bb715d31ae6263d2e0d9fb1e02c9c2c.exe	29

C:\Users\Admin\AppData\Local\Temp\4bb715d31ae6263d2e0d9fb1e02c9c2c.exe
"C:\Users\Admin\AppData\Local\Temp\4bb715d31ae6263d2e0d9fb1e02c9c2c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 856
  2⤵
  - Program crash
  PID:2676

memory/2180-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2180-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download