99b421b433eae70d9b28445cfcfee2185de5511a0c98355f817ba63e65b842c1

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 10:48

Target

bin/Injector.exe
Size

3.4MB
MD5

859d36f3e841dff847048cedda17fe95
SHA1

9c522dfbdfcb67835c6fa1d801952738c3759bed
SHA256

65618512752c7c4f02fd7f10b54b27b1c3a26a433ccbff0f2e90bfc98b306e4c
SHA512

a52fdeffc368d7932e94042710c90502a646909e4fe949602416064fc4715751be017e8b23590feca1dd390cca45f4ae6fe24967ec1697d5df234fcb2bb737ae
SSDEEP

49152:Wx2dqYFpl0sk7CQuZ6MKxGA6DWd2LaDreCoMPGHCgSx4Citttf985qFzXT84B2c6:Wx2dbU7C9cMK4ydSaDiTMOHCt7itt64

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral3/memory/1624-0-0x000000013F590000-0x000000013FB36000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	Injector.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2836	AUDIODG.EXE
Token: 33	2836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2836	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\bin\Injector.exe
"C:\Users\Admin\AppData\Local\Temp\bin\Injector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

memory/1624-0-0x000000013F590000-0x000000013FB36000-memory.dmp

Filesize
5.6MB

Download