cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:45

Target

cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b.exe
Size

1.3MB
MD5

3bee2a41c21fd43ed60019ee8ccec246
SHA1

519bbc63592e8a5476b7a17c22d4bc7f7341cdb2
SHA256

cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b
SHA512

788692a4727da96ef16f460d9a6ec68bd49c62180b692781899355c3049dea15e8e38acbcef539793dd195d8b4bf494a4cc5a7385c3d7317259f2d4b37e730a8
SSDEEP

24576:0XHuNcW0qsp4kslD7NcOwjk0v/vXWXxmTlrPHkxMla9F/GQOPA:0ez0wkY7uNkW8GFHkWUFOQOP

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/1632-55-0x0000000000400000-0x0000000000698000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b.exe

C:\Users\Admin\AppData\Local\Temp\cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b.exe
"C:\Users\Admin\AppData\Local\Temp\cf3fc011e9313ca7d290a356ec8057c6572133c9ed16c481c9218daa3e26ad5b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632

memory/1632-55-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/1632-54-0x0000000001EC0000-0x0000000001FBB000-memory.dmp

Filesize
1004KB

Download