vidar | 97884b8e18ad0f52de4d49417cdffeae030905cde46da43d88f5938349542def

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 02:31

Target

1500-56-0x0000000000A70000-0x0000000001398000-memory.exe
Size

9.2MB
MD5

6d929114a3284888f3f8c10261384391
SHA1

0f928f41f1a7fd8d3e71e1a15fe94e11bf4d9b68
SHA256

97884b8e18ad0f52de4d49417cdffeae030905cde46da43d88f5938349542def
SHA512

07d43745246fec2cb93b736d518c02202ac398b5a0ef021796b5790c3e616b2c819a8af4d2ee49b52cd5b5d15185c0f69cf5f8af10c3000f9ccf0ab9ae7a27e0
SSDEEP

98304:XRYgVvxczu4hvG4TgsCLMjG7ZSj8UruU2fHyQEY0JIi4VaLGGteqp8OH7FCUG:jKtPFru/HKGi4VqGG9XFX

Score

10^/10

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/1340-55-0x00000000004D0000-0x0000000000DF8000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	1340	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1228	1340	1500-56-0x0000000000A70000-0x0000000001398000-memory.exe	27
PID 1340 wrote to memory of 1228	1340	1500-56-0x0000000000A70000-0x0000000001398000-memory.exe	27
PID 1340 wrote to memory of 1228	1340	1500-56-0x0000000000A70000-0x0000000001398000-memory.exe	27
PID 1340 wrote to memory of 1228	1340	1500-56-0x0000000000A70000-0x0000000001398000-memory.exe	27

C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
  2⤵
  - Program crash
  PID:1228

memory/1340-55-0x00000000004D0000-0x0000000000DF8000-memory.dmp

Filesize
9.2MB

Download