e4be5fe5d2aff278b1343f3900ab0cc9e56daa10a8d34cf93faf939595b2b5a3

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 08:47

Target
7cad65fc693c79ddb2936065e753b0c8.exe
Size 6.8MB
Sample240128-kp9nsshbfp
SHA256 e4be5fe5d2aff278b1343f3900ab0cc9e56daa10a8d34cf93faf939595b2b5a3
MD5 7cad65fc693c79ddb2936065e753b0c8
SHA1 f1ca44f7e5538acd2a86e17e876012014060568b
SHA512 f6e0795c8b97e38bda13dcc8fe54b9317ed280d05d1ad4e5c1006efad2d73924f25bd638d5a074cb3ff687bfb2e7f5fd3aaf92c9a6d8d793e2bcdd2198a39575
SSDEEP 196608:mltA5Q0ioyeNmGgXwrgTWwSDbOgKfbVK:mltGiPXXMDDSgKfb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2184-1-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp	vmprotect
behavioral2/memory/2184-2-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp	vmprotect
behavioral2/memory/2184-6-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2184	7cad65fc693c79ddb2936065e753b0c8.exe
2184	7cad65fc693c79ddb2936065e753b0c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2740	2184	7cad65fc693c79ddb2936065e753b0c8.exe	89
PID 2184 wrote to memory of 2740	2184	7cad65fc693c79ddb2936065e753b0c8.exe	89
PID 2184 wrote to memory of 3404	2184	7cad65fc693c79ddb2936065e753b0c8.exe	95
PID 2184 wrote to memory of 3404	2184	7cad65fc693c79ddb2936065e753b0c8.exe	95

C:\Users\Admin\AppData\Local\Temp\7cad65fc693c79ddb2936065e753b0c8.exe
"C:\Users\Admin\AppData\Local\Temp\7cad65fc693c79ddb2936065e753b0c8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color B
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3404

memory/2184-1-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp

Download

memory/2184-2-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp

Download

memory/2184-0-0x00007FFEB7150000-0x00007FFEB7152000-memory.dmp

Download

memory/2184-6-0x00007FF6CE070000-0x00007FF6CEE00000-memory.dmp

Download