e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 03:37

Target

e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe
Size

47KB
MD5

a59b505d070f515b300af2345fc1fe09
SHA1

09409004113ae2915b013736a70dc06f3951f924
SHA256

e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56
SHA512

fb83850e03d4a9b5ca72e46df786e5636f9a4fe1f9e6869ed8bc1f09ab38d3d9d995e07ab6aed73bfd21e970f136dca61544a1fdfd4b204de0bdd6ab74d2c8f0
SSDEEP

768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSya2ZNwm:w0hAW1iqdWNzI5Pd4CSya8wm

Score

9^/10

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000003d70-1.dat	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

pid	Process
2832	QXXX.QXX

Loads dropped DLL 2 IoCs

pid	Process
2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe
2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2832	2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe	29
PID 2056 wrote to memory of 2832	2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe	29
PID 2056 wrote to memory of 2832	2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe	29
PID 2056 wrote to memory of 2832	2056	e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe	29

C:\Users\Admin\AppData\Local\Temp\e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe
"C:\Users\Admin\AppData\Local\Temp\e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\QXXX.QXX
  "C:\Users\Admin\AppData\Local\Temp\QXXX.QXX"
  2⤵
  - Executes dropped EXE
  PID:2832

\Users\Admin\AppData\Local\Temp\QXXX.QXX

Filesize
47KB

MD5
b88225b6fbd1e0e5223271b074369366

SHA1
132173e97a239fcf0b96c34b57fa32c8d824238b

SHA256
37397976f111d98226acc8a70047e6edbc4b987613904149a3ff126cb03ceb7f

SHA512
86cf199455f8181f252d590d55a41b7cf9cb38c40d70fb8f3a32f27fbe52274f7ffb03adc2164189b2b56ece73b003d19c67cc93f8f19401e9f473e0ca532db4

Download Submit