e9be6aac7a3adb3fc4b27a3c6295a4d1f11bbef9e1c2a5b5719c57685650a509

Analysis

max time kernel
132s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 16:23

Target

Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SecureEngineSDK32.dll
Size

28KB
MD5

4a05ec5f2b81d2a10762069474db29e4
SHA1

327cd6152c3b7612b6c27bbc85335047cf20ad86
SHA256

b8602138a1c138ea7fd9df8687e2a1f094959f7357688cbee7b44b060ea8179f
SHA512

209f44159d901bc89369ee6012b13fab4b0d1cbe91657c417fac4b3009e7033da23f8c21fe3b825c171e9de9424dea7b5c071e48afdbbed91a1e1a8744e0cd1a
SSDEEP

192:IMY8s5EvuxBd4uMf9mP3CTND0SqX5xS5caB7UcSAfM5IBizxUv:IMYTxBybPTND0fnjA05

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1428	4392	rundll32.exe	90
PID 4392 wrote to memory of 1428	4392	rundll32.exe	90
PID 4392 wrote to memory of 1428	4392	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\SecureEngineSDK32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\SecureEngineSDK32.dll,#1
  2⤵
  PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:6016

memory/1428-0-0x0000000075270000-0x0000000075279000-memory.dmp

Filesize
36KB

Download