e22671a96d8fb6763eb447545b0627964d68f3609ac95cb44e2ca9dfd7d221b6

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:12

Target

1875f4969b44d0e2cdd6a4c399026311.dll
Size

1.1MB
MD5

1875f4969b44d0e2cdd6a4c399026311
SHA1

1df04d32641a681a2cf8b5454633ac9d2c581b16
SHA256

e22671a96d8fb6763eb447545b0627964d68f3609ac95cb44e2ca9dfd7d221b6
SHA512

c6839992496032ab93ead284c26e7c4d57aa33facba0a178af6616a62ea50a0b45438653f65271c3cdc31a4d17cd318a50f76259b368af453ae24e716f07ffa0
SSDEEP

24576:9j7opUD0O25e4r+JVrsGvrU0wtY54/yh2bknVEqacVx8z4aAD:9HQU4zM4Iwd0wmeyhilqacb8

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1152-0-0x0000000074780000-0x00000000749C5000-memory.dmp	themida
behavioral2/memory/1152-5-0x0000000074780000-0x00000000749C5000-memory.dmp	themida

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1152	4924	rundll32.exe	16
PID 4924 wrote to memory of 1152	4924	rundll32.exe	16
PID 4924 wrote to memory of 1152	4924	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1875f4969b44d0e2cdd6a4c399026311.dll,#1
1⤵
PID:1152

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1875f4969b44d0e2cdd6a4c399026311.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924

memory/1152-1-0x0000000002960000-0x0000000002A39000-memory.dmp

Filesize
868KB

Download
memory/1152-2-0x0000000002A50000-0x0000000002AED000-memory.dmp

Filesize
628KB

Download
memory/1152-4-0x0000000002AF0000-0x0000000002C8E000-memory.dmp

Filesize
1.6MB

Download
memory/1152-3-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/1152-0-0x0000000074780000-0x00000000749C5000-memory.dmp

Filesize
2.3MB

Download
memory/1152-5-0x0000000074780000-0x00000000749C5000-memory.dmp

Filesize
2.3MB

Download