6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 11:02

Target

6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe
Size

13.4MB
MD5

a452bb55f47b045b0a30512cdc862b9e
SHA1

8bce128584ff285c7d5d59761a6fbe1c641bf420
SHA256

6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e
SHA512

d422a22286ed2ea0eca04e79a2641f99cbb2a674c81342b140db50b4ec5ee311977b69b5c23eb6eaae79ae71d7f06db24a14e8b3699d931d21948d76ea786a0f
SSDEEP

196608:C29lPsd2wJf6aBiTtRtNSt8oTbMsQvcGALMLTHQAO/hXT2bwN5iJ6goA:CwNsdTJoTtRetHbrKiLMntOwbRdo

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1936-0-0x0000000000400000-0x0000000001868000-memory.dmp	themida
behavioral2/memory/1936-1-0x0000000000400000-0x0000000001868000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	1936	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe
"C:\Users\Admin\AppData\Local\Temp\6443a335f51f7bf4aea8496cd6d3282c36d99f8056d040254b6d9265e1bc693e.exe"
1⤵
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 516
  2⤵
  - Program crash
  PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1936 -ip 1936
1⤵
PID:3952

memory/1936-0-0x0000000000400000-0x0000000001868000-memory.dmp

Filesize
20.4MB

Download
memory/1936-1-0x0000000000400000-0x0000000001868000-memory.dmp

Filesize
20.4MB

Download