4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 14:35

Target

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe
Size

26.1MB
MD5

a438e9e99a912e8f6824c0d578224c8b
SHA1

0e095c8bb1a9086c0858b1e2811078655f335ee5
SHA256

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf
SHA512

355928170b7adb5272c8a2175839f03ea6d6161c7bb33e20256e23fbbba5caecd44fd96018714926697f6f6847d1892b4dcae7cc02f01f21f50a44891d7c5cd0
SSDEEP

786432:I6C+R8MYMKnS7m2t+4b1x6EtY9V0KDu4tMm:IB+RvYDSq2Zb1x6EtEqHm

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/1460-0-0x00007FF797B50000-0x00007FF799E7E000-memory.dmp	themida
behavioral2/memory/1460-2-0x00007FF797B50000-0x00007FF799E7E000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

pid process

1460 4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

pid	process
1460	4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe

C:\Users\Admin\AppData\Local\Temp\4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe
"C:\Users\Admin\AppData\Local\Temp\4ccae06f2fe343be6ea9985078949204fd7bc8666ae1878d465a052059273ebf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1460

memory/1460-0-0x00007FF797B50000-0x00007FF799E7E000-memory.dmp

Filesize
35.2MB

Download
memory/1460-1-0x00007FFE62750000-0x00007FFE62752000-memory.dmp

Filesize
8KB

Download
memory/1460-2-0x00007FF797B50000-0x00007FF799E7E000-memory.dmp

Filesize
35.2MB

Download