6c8dfbba2dfc6053ef6de63a3eb88e980c4f31fdbd249d30d854314a666fff30

Analysis

max time kernel
61s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:14

Target

ThemidaSDK/SecureEngineSDK32.dll
Size

28KB
MD5

0114de893690b4649b232e47129b1524
SHA1

4d5f0bbe2c13ec0ef65249876ef64a79a688c9f5
SHA256

e2f064755265bc9d393e691217b24708c80143c6b8562112e206b7c2a48fe89f
SHA512

0ee5401efecb0e3d83debaffb41423c4bac8bea49126e168a23500ec7fc1187e977a823f969511b2e780046482d9a63de7d6c2f3d07728726ebc4b5aa49d8578
SSDEEP

192:W8s5GUuxBd/KCeotPpWZlNCry+9XYqX5xS5caV7UcSAfM5IBizxhv:WkxBQCeqPpWZ49XXfnvA05

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1780	2544	rundll32.exe	82
PID 2544 wrote to memory of 1780	2544	rundll32.exe	82
PID 2544 wrote to memory of 1780	2544	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\SecureEngineSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\SecureEngineSDK32.dll,#1
  2⤵
  PID:1780