e9be6aac7a3adb3fc4b27a3c6295a4d1f11bbef9e1c2a5b5719c57685650a509

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 16:23

Target

Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.dll
Size

69KB
MD5

526b73cc04d8515837a5ca78702e210c
SHA1

e3fecadd4ea461cd00c9eb594bade03eb4dbc979
SHA256

1cb663b75bebe168a4ce24f6f48f23c3eb0715ed305ec500032dfe5803daf331
SHA512

1eaf85eb691ef238ea6265ee7817836dcf3b927cbc476cbf925e12fb19921e07281164987ddecbb2d2b2fae9eb35d2cbf0fe3794015a310e9e607ad3efffbdc5
SSDEEP

768:pBwRJJM9RALILLSsPafOwRI02EiO8OaAP6Bu4oPhbYfY/UBBHNEDoiNx:pBwRJJM9RE4/axRPa8nLbv/UP8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28
PID 2188 wrote to memory of 1700	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\Debug\TestPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\Debug\TestPlugin.dll,#1
  2⤵
  PID:1700

memory/1700-2-0x0000000074E60000-0x0000000074E85000-memory.dmp

Filesize
148KB

Download
memory/1700-1-0x0000000074E40000-0x0000000074E65000-memory.dmp

Filesize
148KB

Download
memory/1700-0-0x0000000074E70000-0x0000000074E95000-memory.dmp

Filesize
148KB

Download