8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:53

Target

8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll
Size

2.3MB
MD5

db6614bfdf4e5b3457559382c73cb180
SHA1

3d31ba7e0f12a66fe25280f68e28f50a9da674c7
SHA256

8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842
SHA512

0105b82beab0e39243c6feb96391130e172cf9fff6c2d0d1800e889f2659d921b1a8cda5465bc727824f1a782edd05a437041a84b24d7d1174795417893e7b12
SSDEEP

49152:xTMNIjOjHaFbK9ur55wj7LVL727KktC0ZDL4Th2t3RS2RRCHX0Hg:NFjOj9gILVL727g0gqRzMH

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/316-0-0x00000000744E0000-0x0000000074AFE000-memory.dmp	themida

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28
PID 2068 wrote to memory of 316	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll,#1
  2⤵
  PID:316

memory/316-0-0x00000000744E0000-0x0000000074AFE000-memory.dmp

Filesize
6.1MB

Download
memory/316-1-0x00000000744F0000-0x0000000074B0E000-memory.dmp

Filesize
6.1MB

Download
memory/316-2-0x0000000073ED0000-0x00000000744EE000-memory.dmp

Filesize
6.1MB

Download
memory/316-3-0x00000000744E0000-0x0000000074AFE000-memory.dmp

Filesize
6.1MB

Download