c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c

Analysis

max time kernel
142s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 15:22

Target

c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe
Size

8.3MB
MD5

ff75e05fe93507206643166c03bbc2d1
SHA1

f4bf4cfead4f272c808dfec05b8992dbc597da6e
SHA256

c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c
SHA512

0cb1c5f212553710817ec7beb43f134462a66ee753883fddb8e80c209fc39acf64615ceb0b8aabb0ee1139dbe50b7dc1b748ca816af3a73adb9322623e9dc827
SSDEEP

196608:cH3Z0hf830znOK5Ae2QlN3smb097qxV2qeJn6+onXmvdsac:4efYc933sP97d90mv7c

Score

7^/10

Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

behavioral2/memory/452-0-0x0000000000400000-0x000000000139F000-memory.dmp themida
behavioral2/memory/452-1-0x0000000000400000-0x000000000139F000-memory.dmp themida
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe

pid process

452 c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe

resource	yara_rule
behavioral2/memory/452-0-0x0000000000400000-0x000000000139F000-memory.dmp	themida
behavioral2/memory/452-1-0x0000000000400000-0x000000000139F000-memory.dmp	themida

pid	process
452	c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe

C:\Users\Admin\AppData\Local\Temp\c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe
"C:\Users\Admin\AppData\Local\Temp\c17527ed27a77f32f0cf1af03819e10cb1f3b623ba11c1530ddc4d3492d9109c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:452

memory/452-0-0x0000000000400000-0x000000000139F000-memory.dmp

Filesize
15.6MB

Download
memory/452-1-0x0000000000400000-0x000000000139F000-memory.dmp

Filesize
15.6MB

Download