Analysis
-
max time kernel
66s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28/04/2024, 16:30
General
-
Target
hwcqfz_gr/虎威辅助免费版V3.2.1/虎威辅助免费版V3.2.1/虎威辅助免费版V3.2.1.exe
-
Size
9.7MB
-
MD5
9bede72c6060544a49aa4f311ca8b817
-
SHA1
9bd985f43d46ad85a347efd4ee2a074362c3b14d
-
SHA256
51aaf24fbb42465c539c292fc32e8ce3328fbe022f31239f3888190ea3bb9e7b
-
SHA512
3281232302906754d032bc22a6e7216def2e9f25ca5024cb735445936358d765e40528899bc2e6acd97f57c517081b575d3d0d490365da58e40d25b94537511d
-
SSDEEP
196608:Yfpg/Efv5+PdSgbyTldTLDPCySacUehGFf9/l7Ge:Yfpg8fR+1S1/zChbMF/pGe
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hwcqfz_gr\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1.exe"C:\Users\Admin\AppData\Local\Temp\hwcqfz_gr\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1\虎威辅助免费版V3.2.1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 6602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4288 -ip 42881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.1MB
-
Filesize
20.1MB
-
Filesize
4KB
-
Filesize
20.1MB