21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 08:28

Target

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe
Size

5.5MB
MD5

0b4ad1c3b3f364c3d79fabdb47fe3385
SHA1

85de5462d6342f03eaf3fb48176615fa6fa18508
SHA256

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d
SHA512

c9f6ecb99786613113ae5e02bf9e4a00fcf7036a1bddd07c87f8cb66ce8f45b9515d4fc0321cbf20282556f16645818249d04390335f518afdc1d2253f8dab76
SSDEEP

98304:ao3n7Qvg+PVALF8Ka+EQLkVBbrxkKmrMP2tOmzprZOCgNYWxMuxee4F6OzU7+bgb:aY84EALF8Ka+EUakLrMP2tDrQCg6Wxj5

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2028-2-0x0000000001150000-0x0000000001A46000-memory.dmp	vmprotect
behavioral1/memory/2028-5-0x0000000001150000-0x0000000001A46000-memory.dmp	vmprotect
behavioral1/memory/2028-11-0x0000000001150000-0x0000000001A46000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe

pid process

2028 21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe

pid	process
2028	21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe

C:\Users\Admin\AppData\Local\Temp\21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe
"C:\Users\Admin\AppData\Local\Temp\21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

memory/2028-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000001150000-0x0000000001A46000-memory.dmp

Filesize
9.0MB

Download
memory/2028-3-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000001150000-0x0000000001A46000-memory.dmp

Filesize
9.0MB

Download
memory/2028-7-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2028-8-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2028-11-0x0000000001150000-0x0000000001A46000-memory.dmp

Filesize
9.0MB

Download