e5607ad3b2e8b6698891db174cb23d34a89f849151b8041d3a04c5c47870d773

Analysis

max time kernel
121s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 02:23

Target

Themida v1.8.5.5/Themida_v1.8.5.5/plugmainsp.dll
Size

1.5MB
MD5

f0af6e9533dd7b746c11be780d1114f9
SHA1

10923537c0e200e417631293c2a84696677c6aed
SHA256

adf141f82333c235d196c0969e3ac8f042fc6987afb2cb74af662d3e61d6332e
SHA512

28e6c33f9c12187184d80d884a0fb8c9a66d607388f603213f2e081dde19fce42768eaa158aacd3a4ccf3c568118b0104325874ccaca5d8b0e63811a64aa0afb
SSDEEP

24576:AgJUQ+Ujd9aM7lm8waqQ7B5jGWB9S5yKaXA:Vd+uJJ7HjPbS5U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4336	4220	rundll32.exe	88
PID 4220 wrote to memory of 4336	4220	rundll32.exe	88
PID 4220 wrote to memory of 4336	4220	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Themida v1.8.5.5\Themida_v1.8.5.5\plugmainsp.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Themida v1.8.5.5\Themida_v1.8.5.5\plugmainsp.dll",#1
  2⤵
  PID:4336

memory/4336-0-0x0000000002310000-0x0000000002468000-memory.dmp

Filesize
1.3MB

Download