644e3f15cd7a653087fb7496f311e81ab32f6389d418928d0ad182191bb48104

Analysis

Target
SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe
Size 194KB
Sample200715-p87trmnyb2
SHA256 644e3f15cd7a653087fb7496f311e81ab32f6389d418928d0ad182191bb48104
MD5 ebd7cba68c1604daf37d6f17311ffae9
SHA1 15de9d2d8a782b8acc7ec9aa6826dd55a0cb798f
SHA512 618fed22abcb48685f96bdc963afdc841144c90b9ac943d68b4b5caa5faf1cbb96b21456b0a8d7d7762d398e2f6eac3d612beddba69b7a3c52e370ea66e9377a
MD5 SHA1 SHA512

Score

8^/10

Loads dropped DLL 3 IoCs

pid	Process
1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe
1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe
108	forms.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1448	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	24
PID 1124 wrote to memory of 1448	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	24
PID 1124 wrote to memory of 1448	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	24
PID 1124 wrote to memory of 1448	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	24
PID 1124 wrote to memory of 108	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	25
PID 1124 wrote to memory of 108	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	25
PID 1124 wrote to memory of 108	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	25
PID 1124 wrote to memory of 108	1124	SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe	25
PID 108 wrote to memory of 1628	108	forms.exe	28
PID 108 wrote to memory of 1628	108	forms.exe	28
PID 108 wrote to memory of 1628	108	forms.exe	28
PID 108 wrote to memory of 1628	108	forms.exe	28

Executes dropped EXE 3 IoCs

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc.41518.10122.3887.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\massip.exe
  "C:\Users\Admin\AppData\Local\Temp\massip.exe"
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Users\Admin\AppData\Local\Temp\forms.exe
  "C:\Users\Admin\AppData\Local\Temp\forms.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:108
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1628