d552d463a5bdc43885b1cf4d86b9ed98c80fc877416729b84cf5d4986bec94c2

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 23:42

Target
loader_patched_by_cypher.exe
Size 8.6MB
Sample240302-3qavzaae21
SHA256 d552d463a5bdc43885b1cf4d86b9ed98c80fc877416729b84cf5d4986bec94c2
MD5 c71b1d59edf0689bc03a41f7d7c91843
SHA1 66e7c50307168b279d3d2acac9caeecad5283f52
SHA512 4954b97c5c330b9abf2ca87bbf77f76a8075cdb6008ee1610473f7872858827b58dce0cfb53f61a913781e8a9d6ab254da46308e5a734fc6b83559605973a698
SSDEEP 196608:QPnlJvkC3OOXDLzFgyBRZahPDBlPreVr:Cnz3OcDLzFgy4hPDBt4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/2268-0-0x0000000000010000-0x00000000008BA000-memory.dmp	themida
behavioral1/memory/2268-1-0x0000000000010000-0x00000000008BA000-memory.dmp	themida

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3044	2268	loader_patched_by_cypher.exe	28
PID 2268 wrote to memory of 3044	2268	loader_patched_by_cypher.exe	28
PID 2268 wrote to memory of 3044	2268	loader_patched_by_cypher.exe	28

C:\Users\Admin\AppData\Local\Temp\loader_patched_by_cypher.exe
"C:\Users\Admin\AppData\Local\Temp\loader_patched_by_cypher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 140
  2⤵
  PID:3044

memory/2268-0-0x0000000000010000-0x00000000008BA000-memory.dmp

Download

memory/2268-1-0x0000000000010000-0x00000000008BA000-memory.dmp

Download