0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:45

Target

0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe
Size

9.3MB
MD5

55a74693aacc96564c336d65ae0d510c
SHA1

8d047b80cfa05bf1a5a120ab2bc27bac069ef342
SHA256

0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c
SHA512

1e82842602eebb52170829010ed3aee179a8395d70f83b5a065fa7246e975ba8aa417c9af486569995d9128f03af1c84b26b42c580c954bbf790a2329ce6ced8
SSDEEP

196608:huYcmQeSN7ThUDAwrC+Fr/BVxN+bIVk8JOaSfEqdSXgL5Z4F:h8mfqBh+Z3g+VvSll5Z4F

Score

7^/10

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral1/memory/1688-10-0x0000000000350000-0x00000000004AF000-memory.dmp vmprotect
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe

pid process

1688 0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe
1688 0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe

resource	yara_rule
behavioral1/memory/1688-10-0x0000000000350000-0x00000000004AF000-memory.dmp	vmprotect

pid	process
1688	0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe
1688	0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe

C:\Users\Admin\AppData\Local\Temp\0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe
"C:\Users\Admin\AppData\Local\Temp\0f830ebbcef22b248a8df1abc0b35d5ca2d1817bdf09774f88bb55c32c890b3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688

memory/1688-4-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-18-0x0000000077B90000-0x0000000077B91000-memory.dmp

Filesize
4KB

Download
memory/1688-17-0x0000000077B8F000-0x0000000077B90000-memory.dmp

Filesize
4KB

Download
memory/1688-15-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-19-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-13-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-11-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-10-0x0000000000350000-0x00000000004AF000-memory.dmp

Filesize
1.4MB

Download
memory/1688-8-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-6-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-2-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-0-0x0000000077D00000-0x0000000077D01000-memory.dmp

Filesize
4KB

Download
memory/1688-20-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1688-25-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download