e9be6aac7a3adb3fc4b27a3c6295a4d1f11bbef9e1c2a5b5719c57685650a509

Analysis

max time kernel
136s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 16:23

Target

Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.dll
Size

69KB
MD5

526b73cc04d8515837a5ca78702e210c
SHA1

e3fecadd4ea461cd00c9eb594bade03eb4dbc979
SHA256

1cb663b75bebe168a4ce24f6f48f23c3eb0715ed305ec500032dfe5803daf331
SHA512

1eaf85eb691ef238ea6265ee7817836dcf3b927cbc476cbf925e12fb19921e07281164987ddecbb2d2b2fae9eb35d2cbf0fe3794015a310e9e607ad3efffbdc5
SSDEEP

768:pBwRJJM9RALILLSsPafOwRI02EiO8OaAP6Bu4oPhbYfY/UBBHNEDoiNx:pBwRJJM9RE4/axRPa8nLbv/UP8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1744	4264	rundll32.exe	89
PID 4264 wrote to memory of 1744	4264	rundll32.exe	89
PID 4264 wrote to memory of 1744	4264	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\Debug\TestPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Themida_x32_x64_v3.0.4.0_Repacked\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\Debug\TestPlugin.dll,#1
  2⤵
  PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4108

memory/1744-0-0x0000000075160000-0x0000000075185000-memory.dmp

Filesize
148KB

Download