0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 18:33

Target

0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe
Size

1.3MB
MD5

c2e254fad5099b31405dd14de93a6574
SHA1

5d15a990cbc0e4e46feb8e10006257632ed3241d
SHA256

0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b
SHA512

a26831bd0fb9d9a278da8711a5123bc1170a55ddad417bcecadfbbf128bc2d5eabd0a0e9a2ff110108b69854b7bdbf19c36a53cc59b7f61eda797f48bdec47b9
SSDEEP

24576:KzXKqa8SEiWjC+37z/O9Q8QsB5H04/jrGL5fz1TApIflXbmpp0C6dJ0:Kz6qaahjC+3qK4/jCL5pMAXbOoD0

Score

9^/10

Detects executables packed with VMProtect. 7 IoCs

resource	yara_rule
behavioral1/memory/2140-1-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2140-0-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/files/0x000d0000000143fa-3.dat	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2396-8-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2140-7-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2396-10-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2396-11-0x0000000000400000-0x0000000000495000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

pid	Process
2396	lrsro.exe

Loads dropped DLL 1 IoCs

pid	Process
2140	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\qdklquei\lrsro.exe	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2396	2140	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe	28
PID 2140 wrote to memory of 2396	2140	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe	28
PID 2140 wrote to memory of 2396	2140	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe	28
PID 2140 wrote to memory of 2396	2140	0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe	28

C:\Users\Admin\AppData\Local\Temp\0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe
"C:\Users\Admin\AppData\Local\Temp\0c52dedf4d4132d02cff9b28f4494426d14df54af819dd7ecf1f731cbc90eb2b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\qdklquei\lrsro.exe
  "C:\Program Files (x86)\qdklquei\lrsro.exe"
  2⤵
  - Executes dropped EXE
  PID:2396

\Program Files (x86)\qdklquei\lrsro.exe

Filesize
1.3MB

MD5
4bd82954f40c826307b8fc3f232be554

SHA1
61476d1ac6b691ad40426afdd2f235aa6790f4f6

SHA256
a4de134cf9eaee8dc8a93723ad0a7b16497017f19c53e4664a62a5d1ffc9ecf4

SHA512
51fb0e48d6f342ee1c0b1c3630600e409a6fab57b19409e5e817d3984df812b5c1e0c441a80b38591083952e42e5f2457019e6607a5cd2b8f0cc5efdc79f6aff

Download Submit
memory/2140-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2140-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2140-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2140-9-0x0000000000230000-0x00000000002C5000-memory.dmp

Filesize
596KB

Download
memory/2396-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2396-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2396-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download