bbcfac4a7c17dd02dea9b5fe9982eb8147cd41b7aa3649e90df8aa9c5b39ca88 | Triage

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Private1.exe
Size

2.6MB
MD5

d9111fb07ac007192a6b42ba2517459f
SHA1

d0d6b54d68cbf7acfafb793153c326c2318adf4a
SHA256

bbcfac4a7c17dd02dea9b5fe9982eb8147cd41b7aa3649e90df8aa9c5b39ca88
SHA512

08039b29f9b2218307eca0a5a0df1eff8950decb60d2ae891898b15e9d916b8970a20716a09863471eca99b23f0a41c06e24e9b8eff545af9640d61f82ccda2f
SSDEEP

24576:abxeUYtSGKhowDp2mKSK/07ScciMhhb3jGXCafHv++PuqfFIWFZME7:WXzhpDtKSK1cb8PGK+Tfuqm

Score

7^/10

themida

Malware Config

Signatures

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1788-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1788-1-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	1788	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\Private1.exe
"C:\Users\Admin\AppData\Local\Temp\Private1.exe"
1⤵
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 408
  2⤵
  - Program crash
  PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
1⤵
PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1788-1-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download