Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

Themida_x3...64.exe

windows7-x64

9

Themida_x3...64.exe

windows10-2004-x64

9

Themida_x3...lp.chm

windows7-x64

1

Themida_x3...lp.chm

windows10-2004-x64

1

Themida_x3...in.dll

windows7-x64

1

Themida_x3...in.dll

windows10-2004-x64

1

Themida_x3...in.dll

windows7-x64

1

Themida_x3...in.dll

windows10-2004-x64

1

Themida_x3...in.dll

windows7-x64

3

Themida_x3...in.dll

windows10-2004-x64

3

Themida_x3...ct1.js

windows7-x64

3

Themida_x3...ct1.js

windows10-2004-x64

3

Themida_x3...e.html

windows7-x64

1

Themida_x3...e.html

windows10-2004-x64

1

Themida_x3...ct1.js

windows7-x64

3

Themida_x3...ct1.js

windows10-2004-x64

3

Themida_x3...on.pdf

windows7-x64

1

Themida_x3...on.pdf

windows10-2004-x64

1

Themida_x3...32.dll

windows7-x64

1

Themida_x3...32.dll

windows10-2004-x64

1

Themida_x3...64.dll

windows7-x64

1

Themida_x3...64.dll

windows10-2004-x64

1

Themida_x3...DK.dll

windows7-x64

3

Themida_x3...DK.dll

windows10-2004-x64

3

Themida_x3...ld.exe

windows7-x64

9

Themida_x3...ld.exe

windows10-2004-x64

9

Themida_x3...re.exe

windows7-x64

1

Themida_x3...re.exe

windows10-2004-x64

1

Themida_x3...er.dll

windows7-x64

1

Themida_x3...er.dll

windows10-2004-x64

3

Themida_x3...pv.dll

windows7-x64

1

Themida_x3...pv.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Themida_x32_x64_v3.0.4.0_Repacked/demangler.dll

  • Size

    75KB

  • MD5

    cc74ea40bb1b4eb866f6ee84f6b41a79

  • SHA1

    42023cfd5af17afa02538a5f99141dcda15268e0

  • SHA256

    47d5b5bf9fb06be2fef9f60da10e4b538e4d034937cb98cea143ffbf923c7d02

  • SHA512

    1acc9f478ded50884f2bc9c6b6b5949de3e249696a0b744fecf3322ff306d822469e2e287a629d094735a4123e470b8b1253649a1b9d2dbabac856fc71e2d4d5

  • SSDEEP

    1536:9KoHXYTGjqwOMdjN6A7dzrJBEJszChI5SteqG8Go/fWYyN:9jXYpLMdjAAzB0huStz/fz

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\demangler.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\demangler.dll,#1
      2⤵
        PID:2760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 600
          3⤵
          • Program crash
          PID:3832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2760 -ip 2760
      1⤵
        PID:4900

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2760-0-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download