74866c9e39b3fc10fa60155dad5cfb2e6b98c8d938349584ff6c358bf69c8482

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
09/08/2022, 08:36

Target
SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe
Size 66KB
Sample220809-khk2vsfefm
SHA256 74866c9e39b3fc10fa60155dad5cfb2e6b98c8d938349584ff6c358bf69c8482
MD5 992205e38b5c9e78789e8b6c4affc0b1
SHA1 843608241d1fd54a2b93dfa982fc69e1709047de
SHA512 cc19ae3a804a6f1fdd155a1a89c640abd0130ca6c583962a885e929ab8f4d61617d9c4a62a7370a363f5f1a14aae92c25c642b3926e392da43d07e77e2273313
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1056	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 948	1056	SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe	27
PID 1056 wrote to memory of 948	1056	SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe	27
PID 1056 wrote to memory of 948	1056	SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe	27
PID 1056 wrote to memory of 948	1056	SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.447.2754.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1124
  2⤵
  - Program crash
  PID:948

memory/1056-54-0x0000000000E60000-0x0000000000E74000-memory.dmp

Download

memory/1056-55-0x0000000000340000-0x0000000000348000-memory.dmp

Download

memory/1056-56-0x0000000074E11000-0x0000000074E13000-memory.dmp

Download