e5607ad3b2e8b6698891db174cb23d34a89f849151b8041d3a04c5c47870d773

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 02:23

Target

Themida v1.8.5.5/Themida_v1.8.5.5/sewl2.dll
Size

765KB
MD5

a4b244e94ac7e3dc8e5a264dc1ffa8d8
SHA1

0b4900ef9b40b60e9f79926e3d39772095b0c4d9
SHA256

0c017d6ff1342c20e16abedd69bdc2567575ffe020e183504d93786befaac4ee
SHA512

a38cfc34f3a4bef3d3c560cbf7d40977ee75bc86f4647581cdc8be57a2f10f8ac34c8cd1a61ff60903a5e1d66d24a3650bb0ff18d4e85fdbf1492b2d2b91fe19
SSDEEP

12288:1n0VIELK1qUWdJZYkjk5vldGW+AvoN185pUiJXOWETIsmviUo6NV3a+qCG:1n0CDqkkYpyW+Avoj85pUiJnEBmvRNMn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28
PID 2980 wrote to memory of 3024	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Themida v1.8.5.5\Themida_v1.8.5.5\sewl2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Themida v1.8.5.5\Themida_v1.8.5.5\sewl2.dll",#1
  2⤵
  PID:3024