e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 16:29

Target

e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe
Size

728KB
MD5

eed3e450ce9eeb5fcaed08eb85e16a7c
SHA1

c53ae966ec75111abb91ace89f0f3483685fa298
SHA256

e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4
SHA512

0a779aa7dd7fa4e382cd79382fa4c4c20f044291a021aba805750205eadb44bcc977dbfc627810606eb55ff3ecfaad978890552e466899d33412885a85e71d3f
SSDEEP

12288:fgudMFIV5yvRdKYRv5qA5TzeFPUPxqs8jpf3jRTJqaCvLN5vn1HXsnn23sGKc87e:3yFI+vR8YR7VqF3jF3jl87Fskspc8xFF

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4020-0-0x0000000000400000-0x000000000062F000-memory.dmp	vmprotect
behavioral2/memory/4020-1-0x0000000000400000-0x000000000062F000-memory.dmp	vmprotect

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5088	4020	WerFault.exe	90
3044	4020	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe
"C:\Users\Admin\AppData\Local\Temp\e6ba2a0f7abb7da0f72b4376e7c10af7baa9d7f4746eccb4cd128c8ecc7b19f4.exe"
1⤵
PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 560
  2⤵
  - Program crash
  PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 564
  2⤵
  - Program crash
  PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4020 -ip 4020
1⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
1⤵
PID:1440

memory/4020-0-0x0000000000400000-0x000000000062F000-memory.dmp

Filesize
2.2MB

Download
memory/4020-1-0x0000000000400000-0x000000000062F000-memory.dmp

Filesize
2.2MB

Download