fb3d91b13118a2806a504dee22ad186971ea0be2189f43465adf0fe54f118abb

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 10:33

Target

Woofer.exe
Size

549KB
MD5

21c1702313e421b17d293723f09931eb
SHA1

c9a05ab02ee5c05236256063cd14c424a1402cc4
SHA256

fb3d91b13118a2806a504dee22ad186971ea0be2189f43465adf0fe54f118abb
SHA512

23d8377ef63df16ce0589d5d6552dfea752f4e89359d69ef54543a7a8fc6ac2ceee647886ab30c541e1a793ddef8138cb7112a8740296fc8c1adefa4ee3691fe
SSDEEP

12288:2YU8UoaQn65KH4lczp9f+2k0FQPgJtYlHW7tQJU6hiB:FUoa53q7k0aPgrYlKKhiB

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2028-0-0x00000000010A0000-0x0000000001180000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2540	2028	Woofer.exe	28
PID 2028 wrote to memory of 2540	2028	Woofer.exe	28
PID 2028 wrote to memory of 2540	2028	Woofer.exe	28
PID 2028 wrote to memory of 2540	2028	Woofer.exe	28

C:\Users\Admin\AppData\Local\Temp\Woofer.exe
"C:\Users\Admin\AppData\Local\Temp\Woofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 840
  2⤵
  - Program crash
  PID:2540

memory/2028-0-0x00000000010A0000-0x0000000001180000-memory.dmp

Filesize
896KB

Download
memory/2028-1-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-2-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-3-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-4-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-5-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-6-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-7-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-8-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-9-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2028-10-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download