9066a70491e2563254d958a0a3925c75687224afc705fbde5a235e75b801de10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 16:30

Target

hwcqfz_gr/虎威辅助免费版V3.2.1/虎威辅助免费版V3.2.1/虎威辅助免费版V3.2.1.exe
Size

9.7MB
MD5

9bede72c6060544a49aa4f311ca8b817
SHA1

9bd985f43d46ad85a347efd4ee2a074362c3b14d
SHA256

51aaf24fbb42465c539c292fc32e8ce3328fbe022f31239f3888190ea3bb9e7b
SHA512

3281232302906754d032bc22a6e7216def2e9f25ca5024cb735445936358d765e40528899bc2e6acd97f57c517081b575d3d0d490365da58e40d25b94537511d
SSDEEP

196608:Yfpg/Efv5+PdSgbyTldTLDPCySacUehGFf9/l7Ge:Yfpg8fR+1S1/zChbMF/pGe

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral3/memory/1940-0-0x0000000001320000-0x0000000002737000-memory.dmp	vmprotect
behavioral3/memory/1940-11-0x0000000001320000-0x0000000002737000-memory.dmp	vmprotect
behavioral3/memory/1940-13-0x0000000001320000-0x0000000002737000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	1940	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1940	虎威辅助免费版V3.2.1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	虎威辅助免费版V3.2.1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1940	虎威辅助免费版V3.2.1.exe
1940	虎威辅助免费版V3.2.1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2628	1940	虎威辅助免费版V3.2.1.exe	28
PID 1940 wrote to memory of 2628	1940	虎威辅助免费版V3.2.1.exe	28
PID 1940 wrote to memory of 2628	1940	虎威辅助免费版V3.2.1.exe	28
PID 1940 wrote to memory of 2628	1940	虎威辅助免费版V3.2.1.exe	28

C:\Users\Admin\AppData\Local\Temp\hwcqfz_gr\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\hwcqfz_gr\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 372
  2⤵
  - Program crash
  PID:2628

memory/1940-0-0x0000000001320000-0x0000000002737000-memory.dmp

Filesize
20.1MB

Download
memory/1940-11-0x0000000001320000-0x0000000002737000-memory.dmp

Filesize
20.1MB

Download
memory/1940-7-0x00000000755E0000-0x00000000755E1000-memory.dmp

Filesize
4KB

Download
memory/1940-3-0x0000000077C10000-0x0000000077C11000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000077C10000-0x0000000077C11000-memory.dmp

Filesize
4KB

Download
memory/1940-12-0x0000000077C10000-0x0000000077C11000-memory.dmp

Filesize
4KB

Download
memory/1940-13-0x0000000001320000-0x0000000002737000-memory.dmp

Filesize
20.1MB

Download