3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565

Analysis

Target

3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe
Size

32KB
MD5

0793e40192cb5916d1aeb03e045ddd58
SHA1

4f07512ff629cae2e4175a3e1e4235fa8cee3bfe
SHA256

3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565
SHA512

2b5bfbfc151861dead86d241ad3a6afb76142cb4a6fd2811abfebab4f3026af92f0aee25865d778672a3c8cf0f3496f707a1efba1212067a2471d66b1a7b3226

Score

10^/10

themida

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3680 created 844 3680 WerFault.exe 3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe

description	pid	process	target process
PID 3680 created 844	3680	WerFault.exe	3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/844-118-0x0000000000400000-0x000000000041B396-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 844 WerFault.exe 3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe

pid	pid_target	process	target process
3680	844	WerFault.exe	3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3680 WerFault.exe
Token: SeBackupPrivilege 3680 WerFault.exe
Token: SeDebugPrivilege 3680 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe
"C:\Users\Admin\AppData\Local\Temp\3756c1fcf3f6404582a19c5e1fd23aa043cb71e85700bdf6b0e6df80593ad565.exe"
1⤵
PID:844

memory/844-118-0x0000000000400000-0x000000000041B396-memory.dmp

Filesize
108KB

Download
memory/844-119-0x0000000000400000-0x000000000041B396-memory.dmp

Filesize
108KB

Download
memory/844-120-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/844-121-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/844-122-0x00000000021E0000-0x000000000220D000-memory.dmp

Filesize
180KB

Download
memory/844-123-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/844-124-0x0000000000480000-0x0000000000489000-memory.dmp

Filesize
36KB

Download
memory/844-126-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/844-125-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/844-127-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/844-128-0x00000000022A0000-0x00000000022A6000-memory.dmp

Filesize
24KB

Download