8e52ba8956d643c96cdeb75c43492302cf710a3d2acc852442930dedbe9ea1bb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Target

eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe
Size

921KB
MD5

461c6571e39013140e06e9446a028b37
SHA1

992bec278f375a4cee0d3c130e9363a3955da59a
SHA256

eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357
SHA512

57105bfac84e19fc451f75359199938d7465f7a64dc3e10e6c694d1d53a41eccb3f8ca1f91e8509bcc462b914067fee8056eaa09250bd489ae7488432ad61d4f
SSDEEP

12288:Ewb/OjHHZYKOQnGaGQk8DOwoZ9JDiuMSd/fDmO3q9xK12vh:zbOHH+KJnGqiwG9Jbfd/fDm994gvh

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral19/memory/2916-1-0x00000000013E0000-0x00000000015EC000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2808	2916	eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe	30
PID 2916 wrote to memory of 2808	2916	eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe	30
PID 2916 wrote to memory of 2808	2916	eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe	30

C:\Users\Admin\AppData\Local\Temp\eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe
"C:\Users\Admin\AppData\Local\Temp\eb0d44784227459b3966965eeef8fcd82fd68514b4ca1f1609985001348b9357.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 528
  2⤵
  PID:2808

memory/2916-0-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

Filesize
4KB

Download
memory/2916-1-0x00000000013E0000-0x00000000015EC000-memory.dmp

Filesize
2.0MB

Download