d44dd728b43d1868d0d7422616457cd79d909d4413846969c8541ef871cba7cb | Triage

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2023 11:36

Sharing

Report Analysis Logs

General

Target

_abvtsr4_F.mdat.dll
Size

7.5MB
MD5

bf39eb2da4f28e2197431cd79124a084
SHA1

f6360561ea18fc25ad59974c068778510f569a38
SHA256

da9c04a0aca9e409afc8d61a052834878de7d0fc6a58bcfc1feffa3fca77d8d6
SHA512

788ec679c77f08bf8d52ec48b64003269abde2c075d2dd85958a5c988faf7438cb7371c6eae4ab6e3633647ce2fe9cd2f0707f7a393218d55020ec99ee5d814c
SSDEEP

98304:5HSrVU6Vx6saXmSZYne3/xJLp+gQqVnscZh51Xa33:5HqUBnscZo

Score

7^/10

themida

Malware Config

Signatures

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral6/memory/5028-0-0x0000000074310000-0x0000000074AA1000-memory.dmp	themida
behavioral6/memory/5028-1-0x0000000074310000-0x0000000074AA1000-memory.dmp	themida
behavioral6/memory/5028-2-0x0000000074310000-0x0000000074AA1000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	5028	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5028	1324	rundll32.exe	79
PID 1324 wrote to memory of 5028	1324	rundll32.exe	79
PID 1324 wrote to memory of 5028	1324	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_abvtsr4_F.mdat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_abvtsr4_F.mdat.dll,#1
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 712
    3⤵
    - Program crash
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5028 -ip 5028
1⤵
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5028-0-0x0000000074310000-0x0000000074AA1000-memory.dmp

Filesize
7.6MB

Download
memory/5028-1-0x0000000074310000-0x0000000074AA1000-memory.dmp

Filesize
7.6MB

Download
memory/5028-2-0x0000000074310000-0x0000000074AA1000-memory.dmp

Filesize
7.6MB

Download