65a2038acecf008fd7a9f9d76fdb572df3ca240704cc636eddee0cbf1c1a717a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 03:37

Target

e0ab3195f278352e0ef28912f37867e2.exe
Size

1.4MB
MD5

e0ab3195f278352e0ef28912f37867e2
SHA1

a69746b926cebf2668e9ecd703b6fb2da41c0808
SHA256

65a2038acecf008fd7a9f9d76fdb572df3ca240704cc636eddee0cbf1c1a717a
SHA512

4a0bdbb818371c1a7966afd8d51907accac5a77d49da89c274335c2388073a89207e450b35c9450087f5b46881fc669e3380ae5a06f720b182d9be8b89e2fb3c
SSDEEP

24576:SpUW5kTgO+qi29DhYVzrjU+DkW51clG6rsbIdxRpzcDhIPLMictW:fxCqhIVzr2j48dxRpzcyP47tW

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/2804-0-0x0000000000400000-0x000000000070A000-memory.dmp	themida
behavioral1/memory/2804-4-0x0000000000400000-0x000000000070A000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2804	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28
PID 2804 wrote to memory of 2692	2804	e0ab3195f278352e0ef28912f37867e2.exe	28

C:\Users\Admin\AppData\Local\Temp\e0ab3195f278352e0ef28912f37867e2.exe
"C:\Users\Admin\AppData\Local\Temp\e0ab3195f278352e0ef28912f37867e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 260
  2⤵
  - Program crash
  PID:2692

memory/2804-0-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-1-0x0000000000C00000-0x0000000000F0A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-2-0x0000000000C00000-0x0000000000F0A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-3-0x0000000000C00000-0x0000000000F0A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-4-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-5-0x0000000000C00000-0x0000000000F0A000-memory.dmp

Filesize
3.0MB

Download
memory/2804-6-0x0000000000C00000-0x0000000000F0A000-memory.dmp

Filesize
3.0MB

Download