e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 16:29

Target

e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe
Size

728KB
MD5

eed3e450ce9eeb5fcaed08eb85e16a7c
SHA1

c53ae966ec75111abb91ace89f0f3483685fa298
SHA256

e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4
SHA512

0a779aa7dd7fa4e382cd79382fa4c4c20f044291a021aba805750205eadb44bcc977dbfc627810606eb55ff3ecfaad978890552e466899d33412885a85e71d3f
SSDEEP

12288:fgudMFIV5yvRdKYRv5qA5TzeFPUPxqs8jpf3jRTJqaCvLN5vn1HXsnn23sGKc87e:3yFI+vR8YR7VqF3jF3jl87Fskspc8xFF

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2772-0-0x0000000000400000-0x000000000062F000-memory.dmp	vmprotect
behavioral1/memory/2772-1-0x0000000000400000-0x000000000062F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2940	2772	e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe	28
PID 2772 wrote to memory of 2940	2772	e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe	28
PID 2772 wrote to memory of 2940	2772	e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe	28
PID 2772 wrote to memory of 2940	2772	e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe	28

C:\Users\Admin\AppData\Local\Temp\e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe
"C:\Users\Admin\AppData\Local\Temp\e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 220
  2⤵
  - Program crash
  PID:2940

memory/2772-0-0x0000000000400000-0x000000000062F000-memory.dmp

Filesize
2.2MB

Download
memory/2772-1-0x0000000000400000-0x000000000062F000-memory.dmp

Filesize
2.2MB

Download