51371a17013cda103dc3443ad80056a3dc5e6e270b4ea5df220800f42228808e

Analysis

max time kernel
77s
max time network
83s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-04-2024 20:39

Target

Impact Spoofer/Impact_fixed.exe
Size

6.1MB
MD5

f8164877a685b3ff1aa8a4c7292e699c
SHA1

279aba8c802d15f3507210b6bf702b678e30f5a3
SHA256

20ffe6d5ffeefecc28bef795ba84e3bb8339522e103c32705b0360f24051b12c
SHA512

f381a0789c50a89022acfc764766931ee43577637f6e11240ee6eade6a62f5e84a8c8b68fd2b240eddf184278693279e8a84a4863f2025f568e8acf0833d653c
SSDEEP

98304:IB38757d1xzB92ETr/SG/e6ML0kySVPziZ42xBTBcSn7JNXjEFsZg5:Gs7D1xH3/SG/KL0fSNmZ9xhBj7zzes6

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral6/memory/500-2-0x00007FF78B420000-0x00007FF78BF20000-memory.dmp	vmprotect
behavioral6/memory/500-6-0x00007FF78B420000-0x00007FF78BF20000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Impact_fixed.exe

pid process

500 Impact_fixed.exe
500 Impact_fixed.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Impact_fixed.exe

pid process

500 Impact_fixed.exe

pid	process
500	Impact_fixed.exe
500	Impact_fixed.exe

pid	process
500	Impact_fixed.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Impact_fixed.execmd.exe

description	pid	process	target process
PID 500 wrote to memory of 2380	500	Impact_fixed.exe	cmd.exe
PID 500 wrote to memory of 2380	500	Impact_fixed.exe	cmd.exe
PID 2380 wrote to memory of 2244	2380	cmd.exe	certutil.exe
PID 2380 wrote to memory of 2244	2380	cmd.exe	certutil.exe
PID 2380 wrote to memory of 536	2380	cmd.exe	find.exe
PID 2380 wrote to memory of 536	2380	cmd.exe	find.exe
PID 2380 wrote to memory of 4900	2380	cmd.exe	find.exe
PID 2380 wrote to memory of 4900	2380	cmd.exe	find.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Impact Spoofer\Impact_fixed.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Impact Spoofer\Impact_fixed.exe" MD5
3⤵
PID:2244

memory/500-2-0x00007FF78B420000-0x00007FF78BF20000-memory.dmp

Filesize
11.0MB

Download
memory/500-0-0x00007FF8D8400000-0x00007FF8D8402000-memory.dmp

Filesize
8KB

Download
memory/500-6-0x00007FF78B420000-0x00007FF78BF20000-memory.dmp

Filesize
11.0MB

Download