a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 02:08

Target

a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe
Size

5.2MB
MD5

628389a81df8f47986a437281568cb1f
SHA1

2d32fa10eef9d49ea18cd8c3e5e94e71603ad3f0
SHA256

a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36
SHA512

8d9879f8e3e5f92869478ed88f45e22a55502828793560b00933cb557aeee6a8740de3d66a926a0826d92b4e9bc6faf5d67bc4ef2687556648fd58046bd16317
SSDEEP

98304:Q4UuJam8M/k/0n+415zScTqve6DOAsqnYddvgXLTimAW6Llw:v/Imz/Znj86NvsTB

Score

9^/10

vmprotect

Detects executables packed with VMProtect. 1 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\siqe\vtwymb.exe	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

Processes:

vtwymb.exe

pid process

2956 vtwymb.exe
Loads dropped DLL 1 IoCs

Processes:

a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

pid process

2120 a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

pid	process
2956	vtwymb.exe

pid	process
2120	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
\Program Files (x86)\siqe\vtwymb.exe	vmprotect

Drops file in Program Files directory 1 IoCs

Processes:

a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

description ioc process

File created C:\Program Files (x86)\siqe\vtwymb.exe a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

description	ioc	process
File created	C:\Program Files (x86)\siqe\vtwymb.exe	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe

description	pid	process	target process
PID 2120 wrote to memory of 2956	2120	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe	vtwymb.exe
PID 2120 wrote to memory of 2956	2120	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe	vtwymb.exe
PID 2120 wrote to memory of 2956	2120	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe	vtwymb.exe
PID 2120 wrote to memory of 2956	2120	a8d6d0e4e16c4191731ec33a8c32529be895db94ac27ecf553b1d044f46f3f36.exe	vtwymb.exe

C:\Program Files (x86)\siqe\vtwymb.exe
"C:\Program Files (x86)\siqe\vtwymb.exe"
2⤵
- Executes dropped EXE
PID:2956

\Program Files (x86)\siqe\vtwymb.exe
Filesize
5.2MB

MD5
79a7d442d6dc918fcc1af56307ec45c8

SHA1
cd1bceb7e17ceca9b0fd2d35ab2dc3045e70dd75

SHA256
1593621009d6615b713bfec103c3fc1fc2424500c1e689c776683349096d042d

SHA512
933c6014469f3a27024f49c3bfe524df40d0be0c8c1088c2066b8ded1cced59dd5562705cc18d0ccc987def6294d0c1f2a524fc9c1d71ff6e107f3d3b116a503

Download Submit