c1565a00a128b1e4f8144a991e50b0c0d08ec0052b7fbe45fb1908e4fab609d2

Analysis

user interaction
yes
max time kernel
10s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 01:18

Target
apwin.exe
Size 9.9MB
Sample260506-bpd3fsds2p
SHA256 c1565a00a128b1e4f8144a991e50b0c0d08ec0052b7fbe45fb1908e4fab609d2
MD5 6cb841ff08e6a52592f537970cde4949
SHA1 60f799ffb1e88d8203706335d6a99ea01ec7c892
SHA512 d374071ae3a30d6d458e3026fde48398bce92b14fd79536a12249b740fa0c99ba5644bb9b1b10d68b24227b5d6d4b1a135fe5173e7a59f4f065a8d1b7f9391f7
SSDEEP 196608:vQ/zjPXMHf3tC+ovS5FTtQAXa/Wg6oqJ1xX:I/zj0H6v2TtQAXZoAl
TLSH
T17DA69FF320D2ABDEC45AC6BA8302FC7FC68F75750A17E0A391A9A36A6D13C447524F15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/4832-0-0x0000000140000000-0x0000000140A32000-memory.dmp	themida

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4932	4832	apwin.exe	80

C:\Users\Admin\AppData\Local\Temp\apwin.exe
"C:\Users\Admin\AppData\Local\Temp\apwin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4932

memory/4832-0-0x0000000140000000-0x0000000140A32000-memory.dmp

Download