6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4 | Triage

Analysis

max time kernel
154s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 16:37

Sharing

Report Analysis Logs

General

Target

6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe
Size

2.7MB
MD5

2f747ac7c1f8eb239f750afbb8a16305
SHA1

ae96c7ba420e241647caca72c1c66838d9b039a7
SHA256

6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4
SHA512

c4f83396016ab862a01bc787979191bb8dee2c91ccdc998fd76504910fc61f523ea81ee2df97facd2ae91fa44d6355412c5fea1c76ce3277c66db7ae0b597556

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/1868-132-0x00000000002D0000-0x00000000009E8000-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 1868 WerFault.exe 6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe

C:\Users\Admin\AppData\Local\Temp\6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe
"C:\Users\Admin\AppData\Local\Temp\6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe"
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 236
2⤵
- Program crash
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1868 -ip 1868
1⤵
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-130-0x00000000002D0000-0x00000000009E8000-memory.dmp

Filesize
7.1MB

Download
memory/1868-131-0x00000000002D0000-0x00000000009E8000-memory.dmp

Filesize
7.1MB

Download
memory/1868-132-0x00000000002D0000-0x00000000009E8000-memory.dmp

Filesize
7.1MB

Download