878e76bea8245e98c3201c3f78d93d499530d7cbd4bba872ed7b87e11e141eeb | Triage

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-07-2022 23:44

Sharing

Report Analysis Logs

General

Target

file.exe
Size

6.9MB
MD5

0f9c90b203db95cf2e4c31d62139025f
SHA1

8719ef5f9774381a83466e8bbb0de0f82e803665
SHA256

878e76bea8245e98c3201c3f78d93d499530d7cbd4bba872ed7b87e11e141eeb
SHA512

a6b56f132c2f08fb114742a48c4414b4f5f92259ea2cbb70e9674027cfdc01c369ab783bd080743d25df79fe5d28d24de0763006c3139d6ccc2237a772644113

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/3696-130-0x00000000001B0000-0x000000000089D000-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

816 3696 WerFault.exe file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 220
2⤵
- Program crash
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3696 -ip 3696
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3696-130-0x00000000001B0000-0x000000000089D000-memory.dmp

Filesize
6.9MB

Download