4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 14:35

Target

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe
Size

26.1MB
MD5

a438e9e99a912e8f6824c0d578224c8b
SHA1

0e095c8bb1a9086c0858b1e2811078655f335ee5
SHA256

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf
SHA512

355928170b7adb5272c8a2175839f03ea6d6161c7bb33e20256e23fbbba5caecd44fd96018714926697f6f6847d1892b4dcae7cc02f01f21f50a44891d7c5cd0
SSDEEP

786432:I6C+R8MYMKnS7m2t+4b1x6EtY9V0KDu4tMm:IB+RvYDSq2Zb1x6EtEqHm

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral1/memory/2884-0-0x000000013F5D0000-0x00000001418FE000-memory.dmp	themida
behavioral1/memory/2884-2-0x000000013F5D0000-0x00000001418FE000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

pid process

2884 4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

pid	process
2884	4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

C:\Users\Admin\AppData\Local\Temp\4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe
"C:\Users\Admin\AppData\Local\Temp\4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2884

memory/2884-0-0x000000013F5D0000-0x00000001418FE000-memory.dmp

Filesize
35.2MB

Download
memory/2884-1-0x00000000774A0000-0x00000000774A2000-memory.dmp

Filesize
8KB

Download
memory/2884-2-0x000000013F5D0000-0x00000001418FE000-memory.dmp

Filesize
35.2MB

Download