8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 11:53

Target

8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll
Size

2.3MB
MD5

db6614bfdf4e5b3457559382c73cb180
SHA1

3d31ba7e0f12a66fe25280f68e28f50a9da674c7
SHA256

8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842
SHA512

0105b82beab0e39243c6feb96391130e172cf9fff6c2d0d1800e889f2659d921b1a8cda5465bc727824f1a782edd05a437041a84b24d7d1174795417893e7b12
SSDEEP

49152:xTMNIjOjHaFbK9ur55wj7LVL727KktC0ZDL4Th2t3RS2RRCHX0Hg:NFjOj9gILVL727g0gqRzMH

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/2968-0-0x00000000743F0000-0x0000000074A0E000-memory.dmp	themida

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2968	896	rundll32.exe	81
PID 896 wrote to memory of 2968	896	rundll32.exe	81
PID 896 wrote to memory of 2968	896	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ffca50cb3724f03e72974c6bd16061258cfaee595665f2797d952b0f8d93842.dll,#1
  2⤵
  PID:2968

memory/2968-0-0x00000000743F0000-0x0000000074A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2968-1-0x00000000743F0000-0x0000000074419000-memory.dmp

Filesize
164KB

Download