e3c21f2f79c6a027881f1b74728c61d4fbb6fe6921f8840ce2dc11aabc9ceaa4

Resubmissions

22-01-2021 15:07

22-01-2021 15:00

22-01-2021 09:16

Target

SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe
Size

8.8MB
MD5

8b664f8a44dcb056095bc43bcb854c11
SHA1

3f54621b0fd5bb9ae4f20c41fdc937a6654f9269
SHA256

e3c21f2f79c6a027881f1b74728c61d4fbb6fe6921f8840ce2dc11aabc9ceaa4
SHA512

71d2a1359a7ff610d3b64eeeebc406ca2b00139db0b73484a679563eb5424a7fbd194dde7f2cca0cee6f5f240f58f2541e809d2d880dc32b7f6009335e066d51

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2212	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2212	648	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe	73
PID 648 wrote to memory of 2212	648	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe	73
PID 648 wrote to memory of 2212	648	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe	73

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\is-FU934.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FU934.tmp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.tmp" /SL5="$2011C,8956095,58368,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.34557.26355.31649.exe"
  2⤵
  - Executes dropped EXE
  PID:2212

memory/648-4-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/2212-5-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download