c5e6c279e9383f9f26903381952a2b9f623f6b8a0c724bfaa5fc38ca69825423

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 23:24

Target

c45faa02fdd378d5098f1e4132e3fbac.exe
Size

5.3MB
MD5

c45faa02fdd378d5098f1e4132e3fbac
SHA1

c3c4535fa1032d8110db264a2c386c6bb5bd4de8
SHA256

c5e6c279e9383f9f26903381952a2b9f623f6b8a0c724bfaa5fc38ca69825423
SHA512

8660abbd84464ea61e3884899afe3f3c5052ba1095ced6fdb9cb1f5154b3d915c3071bea65a2c4269f335f45de242d67542674d4769b51dca381b7decaa4019d
SSDEEP

98304:je4cj4NrLIeoLWO342nLzGFTLlyCxGE8ZQZj/PPxyt:Y4CeJs4MGFTECUEjj/RG

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4540-2-0x00007FF782040000-0x00007FF78292D000-memory.dmp	vmprotect
behavioral2/memory/4540-1-0x00007FF782040000-0x00007FF78292D000-memory.dmp	vmprotect
behavioral2/memory/4540-5-0x00007FF782040000-0x00007FF78292D000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	c45faa02fdd378d5098f1e4132e3fbac.exe
4540	c45faa02fdd378d5098f1e4132e3fbac.exe

C:\Users\Admin\AppData\Local\Temp\c45faa02fdd378d5098f1e4132e3fbac.exe
"C:\Users\Admin\AppData\Local\Temp\c45faa02fdd378d5098f1e4132e3fbac.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4540

memory/4540-0-0x00007FFC41390000-0x00007FFC41392000-memory.dmp

Filesize
8KB

Download
memory/4540-2-0x00007FF782040000-0x00007FF78292D000-memory.dmp

Filesize
8.9MB

Download
memory/4540-1-0x00007FF782040000-0x00007FF78292D000-memory.dmp

Filesize
8.9MB

Download
memory/4540-5-0x00007FF782040000-0x00007FF78292D000-memory.dmp

Filesize
8.9MB

Download