74363df5c1430f515603de68de99ddc7dd22142c45122e83ef056c60f67fdde7

Analysis

user interaction
yes
max time kernel
898s
max time network
751s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:46

Target
vBot.exe
Size 7.0MB
Sample260731-ebvptscb67
SHA256 74363df5c1430f515603de68de99ddc7dd22142c45122e83ef056c60f67fdde7
MD5 f613a2bf8beb8224f8dc8e7dbdeea1b8
SHA1 acf1c3f2fa9ba40360bfabd453d3894f4e50c3e5
SHA512 460b73071c929d2701d8c371eb245e3d2efcd6406eb64f4e891ac591f0ce191d872418fbc090d0750b7994480b7840cbc74fb286ba72b802071f7022dcfccbe2
SSDEEP 196608:g7T+v39g/ouuAcTv9cNySdwXm7EBdTk/ZlMa:oT+vSwDZTEyS77EBdTkD
TLSH
T1F676126333951060D0E1C8364937FDBD72FA5A0B8B818CB765D9BEC62A325E5E623743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/476-1-0x0000000000C90000-0x0000000001389000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
476	vBot.exe
476	vBot.exe

C:\Users\Admin\AppData\Local\Temp\vBot.exe
"C:\Users\Admin\AppData\Local\Temp\vBot.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4164

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3560

memory/476-2-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/476-1-0x0000000000C90000-0x0000000001389000-memory.dmp

Download