1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea | Triage

Analysis

max time kernel
21s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 17:49

Sharing

Report Analysis Logs

General

Target

1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea.exe
Size

8.2MB
MD5

5b82b1c965ec9f299610a19d69496fe5
SHA1

a0f189bd06817a4af77e8384144d5a4ed13ca632
SHA256

1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea
SHA512

a826f334b7b3ab842d2d83d4314a0074699a7c866dd5d1db091997ba73f5bdbcc45396bc180f229276794ea1636276950477bd043dec480460cd528308835740

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/4736-131-0x0000000000F80000-0x0000000001EE4000-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4232 4736 WerFault.exe 1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea.exe

C:\Users\Admin\AppData\Local\Temp\1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea.exe
"C:\Users\Admin\AppData\Local\Temp\1d5a5300a090e82a5364ae76282d0529ee07f5e891bb5f6b03eaf22220ddbcea.exe"
1⤵
PID:4736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4736 -s 304
2⤵
- Program crash
PID:4232

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4736 -ip 4736
1⤵
PID:3436

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-130-0x0000000000F80000-0x0000000001EE4000-memory.dmp

Filesize
15.4MB

Download
memory/4736-131-0x0000000000F80000-0x0000000001EE4000-memory.dmp

Filesize
15.4MB

Download