Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2024 23:24

General

  • Target

    c45faa02fdd378d5098f1e4132e3fbac.exe

  • Size

    5.3MB

  • MD5

    c45faa02fdd378d5098f1e4132e3fbac

  • SHA1

    c3c4535fa1032d8110db264a2c386c6bb5bd4de8

  • SHA256

    c5e6c279e9383f9f26903381952a2b9f623f6b8a0c724bfaa5fc38ca69825423

  • SHA512

    8660abbd84464ea61e3884899afe3f3c5052ba1095ced6fdb9cb1f5154b3d915c3071bea65a2c4269f335f45de242d67542674d4769b51dca381b7decaa4019d

  • SSDEEP

    98304:je4cj4NrLIeoLWO342nLzGFTLlyCxGE8ZQZj/PPxyt:Y4CeJs4MGFTECUEjj/RG

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c45faa02fdd378d5098f1e4132e3fbac.exe
    "C:\Users\Admin\AppData\Local\Temp\c45faa02fdd378d5098f1e4132e3fbac.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3040-3-0x000000013F4D0000-0x000000013FDBD000-memory.dmp

    Filesize

    8.9MB

  • memory/3040-2-0x0000000077530000-0x0000000077532000-memory.dmp

    Filesize

    8KB

  • memory/3040-0-0x0000000077530000-0x0000000077532000-memory.dmp

    Filesize

    8KB

  • memory/3040-7-0x0000000077380000-0x0000000077529000-memory.dmp

    Filesize

    1.7MB

  • memory/3040-6-0x000000013F4D0000-0x000000013FDBD000-memory.dmp

    Filesize

    8.9MB

  • memory/3040-5-0x0000000077530000-0x0000000077532000-memory.dmp

    Filesize

    8KB

  • memory/3040-10-0x000000013F4D0000-0x000000013FDBD000-memory.dmp

    Filesize

    8.9MB

  • memory/3040-11-0x0000000077380000-0x0000000077529000-memory.dmp

    Filesize

    1.7MB