13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 18:53

Target

13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe
Size

6.1MB
MD5

6433ae346830b2f9ba006ba9343a9ef3
SHA1

af023f8f3685a02e2aed91b68e3e23e931f5b2d4
SHA256

13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9
SHA512

4e9cb52dbe44e4625aa6f2c7ae444dc48c24ad17392ec94e038a3a60ef0d61a944d91c4f77809eaf0c9816f2b5a36f8c2e17387e2c44c7ba5e1e74639a6394b3
SSDEEP

196608:SHYPy5alLXec6ePjX1JqvWzKJX6Uc+bUGGzzT:SH5alLXec6ePjXPqvWWRXcwUGw

Score

9^/10

Detects executables packed with VMProtect. 7 IoCs

resource	yara_rule
behavioral2/memory/4912-1-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4912-0-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/files/0x0009000000023380-4.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4912-6-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4788-5-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4788-8-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4788-9-0x0000000000400000-0x0000000000494000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

pid	Process
4788	sxjtwmk.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\lohvpyt\sxjtwmk.exe	13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4788	4912	13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe	84
PID 4912 wrote to memory of 4788	4912	13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe	84
PID 4912 wrote to memory of 4788	4912	13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe	84

C:\Users\Admin\AppData\Local\Temp\13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe
"C:\Users\Admin\AppData\Local\Temp\13cff2ecee7cd9fcd3d9e3bd1d82bf7283299acbc028063c4f2a4d3c6e0387f9.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\lohvpyt\sxjtwmk.exe
  "C:\Program Files (x86)\lohvpyt\sxjtwmk.exe"
  2⤵
  - Executes dropped EXE
  PID:4788

C:\Program Files (x86)\lohvpyt\sxjtwmk.exe

Filesize
6.1MB

MD5
52dff2e4a8decdbcac4b40697abbd24a

SHA1
47b23d9ec6ea31fd06990d072ab114ccc3a34768

SHA256
3cc724e8c714f76333c7974addb85f65ef7e5f11a7b6b6c85cc15ca24791a692

SHA512
aac0a71acfa925d6f8eaaff74db94a2c5a4c184d88988ca39faf63225e7d951be35bf9c39161bd3bd92947679a4d480d5108a172363c63a50fc85762e2077555

Download Submit
memory/4788-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4788-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4788-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4912-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4912-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4912-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download