cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e

Analysis

Target

cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe
Size

32KB
MD5

d7a713e57405859e14321f8bebd9916b
SHA1

d2de0e59242a540a633a4ce8be7e7310b0eca618
SHA256

cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e
SHA512

ae51405fb97d3ec289d5f033b7dde2d7cd27acc6a51b8000fe426b4cbf0c37f38c11e7524012e6da4736746e30aa4d4fee15f7adfd2dea59b9305b4af43d805b

Score

10^/10

themida

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 864 created 3348 864 WerFault.exe cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe

description	pid	process	target process
PID 864 created 3348	864	WerFault.exe	cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/3348-116-0x0000000000400000-0x000000000041B3BE-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

864 3348 WerFault.exe cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe

pid	pid_target	process	target process
864	3348	WerFault.exe	cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 864 WerFault.exe
Token: SeBackupPrivilege 864 WerFault.exe
Token: SeDebugPrivilege 864 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe
"C:\Users\Admin\AppData\Local\Temp\cdd61a00a8175f1753b55094be506bd9fc1a6511a3f0abeeed0216b1db17e95e.exe"
1⤵
PID:3348

memory/3348-116-0x0000000000400000-0x000000000041B3BE-memory.dmp

Filesize
108KB

Download
memory/3348-115-0x0000000000400000-0x000000000041B3BE-memory.dmp

Filesize
108KB

Download
memory/3348-117-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/3348-118-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3348-123-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3348-122-0x00000000021F0000-0x00000000021F9000-memory.dmp

Filesize
36KB

Download
memory/3348-121-0x00000000021C0000-0x00000000021ED000-memory.dmp

Filesize
180KB

Download
memory/3348-119-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/3348-124-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3348-120-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3348-125-0x00000000022B0000-0x00000000022B6000-memory.dmp

Filesize
24KB

Download