6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/12/2023, 11:02

Target

6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe
Size

13.4MB
MD5

a452bb55f47b045b0a30512cdc862b9e
SHA1

8bce128584ff285c7d5d59761a6fbe1c641bf420
SHA256

6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e
SHA512

d422a22286ed2ea0eca04e79a2641f99cbb2a674c81342b140db50b4ec5ee311977b69b5c23eb6eaae79ae71d7f06db24a14e8b3699d931d21948d76ea786a0f
SSDEEP

196608:C29lPsd2wJf6aBiTtRtNSt8oTbMsQvcGALMLTHQAO/hXT2bwN5iJ6goA:CwNsdTJoTtRetHbrKiLMntOwbRdo

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/1872-0-0x0000000000400000-0x0000000001868000-memory.dmp	themida
behavioral1/memory/1872-1-0x0000000000400000-0x0000000001868000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	1872	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2352	1872	6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe	28
PID 1872 wrote to memory of 2352	1872	6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe	28
PID 1872 wrote to memory of 2352	1872	6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe	28
PID 1872 wrote to memory of 2352	1872	6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe	28

C:\Users\Admin\AppData\Local\Temp\6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe
"C:\Users\Admin\AppData\Local\Temp\6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 184
  2⤵
  - Program crash
  PID:2352

memory/1872-0-0x0000000000400000-0x0000000001868000-memory.dmp

Filesize
20.4MB

Download
memory/1872-1-0x0000000000400000-0x0000000001868000-memory.dmp

Filesize
20.4MB

Download