ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac

Analysis

max time kernel
22s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:18

Target

ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe
Size

1.3MB
MD5

4626b93fde5d674fb976d4db54febdc2
SHA1

5476d5c7267b3482870ad6e737f2def5f772bb0f
SHA256

ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac
SHA512

4479499a49d1cb086740dce7d5b2f5c0343668c6466d512c766003920e09e61626094bc6666b449ececd06f554fdd1d77e74886182fa3181a2f88036fbd8f55d
SSDEEP

24576:ofJ0d7kdHOat+Qkt+0/m7R0k80i1cjiXOHL/vPqK9qXz+ojQLiJGbZdOmK:oxQkpOat+QQ+VejNq3FoSlZd0

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/876-55-0x0000000000400000-0x000000000068CB00-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	876	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1908	876	ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe	28
PID 876 wrote to memory of 1908	876	ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe	28
PID 876 wrote to memory of 1908	876	ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe	28
PID 876 wrote to memory of 1908	876	ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe	28

C:\Users\Admin\AppData\Local\Temp\ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe
"C:\Users\Admin\AppData\Local\Temp\ac4c7e5e63848275a7bbf7350326042344bfd23109aa2295efda0994742a76ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 92
  2⤵
  - Program crash
  PID:1908

memory/876-55-0x0000000000400000-0x000000000068CB00-memory.dmp

Filesize
2.5MB

Download