6c8dfbba2dfc6053ef6de63a3eb88e980c4f31fdbd249d30d854314a666fff30

Analysis

max time kernel
60s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:14

Target

ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dll
Size

2.0MB
MD5

e08135766e6d14cf1ead4393eb33eeb4
SHA1

760f16fd201dc55fc68a8c030aaa7e98f6f5f519
SHA256

e67fa2a9c9fe7dbf8e29143d8bd1222422bfe08ef368e8e046bbee9a8dd731ee
SHA512

3bc9d6e8ee3690e1adcd667faa3e5eb35731b4c6d1abfde518959e704f50806493453133be7d1f6a419e87ac9df0aa09dac7dd6f65e23de37435c0a3a827952f
SSDEEP

24576:50Xy3Vsv/hQMcUGBZ4/NEZfqYfMWj1YT/hBUSMmPTfQAYe5ft07VBCgZkQlFE3:aC+/lKtMtbhCStP0A4UbQlF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	3816	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3816	1556	rundll32.exe	82
PID 1556 wrote to memory of 3816	1556	rundll32.exe	82
PID 1556 wrote to memory of 3816	1556	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Plugins\Examples\Delphi\TestPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Plugins\Examples\Delphi\TestPlugin.dll,#1
  2⤵
  PID:3816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 716
    3⤵
    - Program crash
    PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3816 -ip 3816
1⤵
PID:2004

memory/3816-133-0x0000000000400000-0x0000000000619000-memory.dmp

Filesize
2.1MB

Download