5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5

Resubmissions

05-09-2023 01:34

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 01:20

Target

e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
Size

6.9MB
MD5

acc8d28b6efffe73bc7087b610c6dd9f
SHA1

ee5d1ce578c07a8378189e72345277efc696c090
SHA256

e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1
SHA512

a94ce3d5795d13d4474a0afcbd65772d4d34f5756f2ae961f5082aa0570e078ea410aafc893cff54e2a1fad2b690de7060754aafbd48b3a9f1b2d28753b9db7c
SSDEEP

196608:MYh4Y2TV9xyWZzP+EyNlbof4N9XxuzeS5fWPs1:VuYW1PK9owN9BceifWPS

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral16/memory/4420-10-0x0000000000880000-0x0000000001342000-memory.dmp	vmprotect
behavioral16/memory/4420-12-0x0000000000880000-0x0000000001342000-memory.dmp	vmprotect
behavioral16/memory/4420-14-0x0000000000880000-0x0000000001342000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe

pid	process
4420	e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
4420	e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
4420	e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
4420	e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe

C:\Users\Admin\AppData\Local\Temp\e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
"C:\Users\Admin\AppData\Local\Temp\e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420

memory/4420-2-0x0000000001920000-0x0000000001921000-memory.dmp

Filesize
4KB

Download
memory/4420-6-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/4420-5-0x0000000001970000-0x0000000001971000-memory.dmp

Filesize
4KB

Download
memory/4420-4-0x0000000001960000-0x0000000001961000-memory.dmp

Filesize
4KB

Download
memory/4420-7-0x0000000001990000-0x0000000001991000-memory.dmp

Filesize
4KB

Download
memory/4420-3-0x0000000001950000-0x0000000001951000-memory.dmp

Filesize
4KB

Download
memory/4420-1-0x00000000008F7000-0x0000000000C83000-memory.dmp

Filesize
3.5MB

Download
memory/4420-0-0x0000000001910000-0x0000000001911000-memory.dmp

Filesize
4KB

Download
memory/4420-10-0x0000000000880000-0x0000000001342000-memory.dmp

Filesize
10.8MB

Download
memory/4420-12-0x0000000000880000-0x0000000001342000-memory.dmp

Filesize
10.8MB

Download
memory/4420-13-0x00000000008F7000-0x0000000000C83000-memory.dmp

Filesize
3.5MB

Download
memory/4420-14-0x0000000000880000-0x0000000001342000-memory.dmp

Filesize
10.8MB

Download