df999975739b71b9dcea15b853d9573b5e9fcb60e899b3902d9ba8c4238b3cbc

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:29

Target

75185ddb696b6ba7e7318113c8e73f5d.exe
Size

559KB
MD5

75185ddb696b6ba7e7318113c8e73f5d
SHA1

0349f80261a27286f1c0674043ca64cccdf7cdd0
SHA256

df999975739b71b9dcea15b853d9573b5e9fcb60e899b3902d9ba8c4238b3cbc
SHA512

ac84b29b427d91e0b0c06ac4affded56bb5736be37b512e4ed8e205fa300538cb2599fee9fd52bcdf9e549689b27d0d73c5f4fd20a0de6b0ab02cd6208f052f0
SSDEEP

12288:2eGDe7sTWweIQYQpCxz5KeJkkK23mtTCoLj2TGhABeXDP1PwM+st/5:28ATWwed1pOAeJkkK0oLj2TGhAB2DP15

Score

7^/10

themida

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral1/memory/1728-1-0x0000000010000000-0x000000001008E000-memory.dmp	themida
behavioral1/memory/2812-6-0x0000000000400000-0x0000000000403000-memory.dmp	themida
behavioral1/memory/1728-7-0x0000000010000000-0x000000001008E000-memory.dmp	themida
behavioral1/memory/2812-9-0x0000000000400000-0x0000000000403000-memory.dmp	themida
behavioral1/memory/2812-10-0x0000000000400000-0x0000000000403000-memory.dmp	themida

Suspicious use of SetThreadContext 1 IoCs

Processes:

75185ddb696b6ba7e7318113c8e73f5d.exe

description	pid	Process	procid_target
PID 1728 set thread context of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2732	2812	WerFault.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

75185ddb696b6ba7e7318113c8e73f5d.exe75185ddb696b6ba7e7318113c8e73f5d.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 1728 wrote to memory of 2812	1728	75185ddb696b6ba7e7318113c8e73f5d.exe	28
PID 2812 wrote to memory of 2732	2812	75185ddb696b6ba7e7318113c8e73f5d.exe	29
PID 2812 wrote to memory of 2732	2812	75185ddb696b6ba7e7318113c8e73f5d.exe	29
PID 2812 wrote to memory of 2732	2812	75185ddb696b6ba7e7318113c8e73f5d.exe	29
PID 2812 wrote to memory of 2732	2812	75185ddb696b6ba7e7318113c8e73f5d.exe	29

memory/1728-1-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download
memory/1728-7-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download
memory/2812-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2812-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2812-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2812-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2812-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2812-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download