ccfa2a67d01921867191fc088fd2e3c5c60209b1e6423e1586218d739f47a145

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/08/2022, 18:35

Target
SecuriteInfo.com.Variant.Lazy.232996.11026.exe
Size 110KB
Sample220820-w8bfwsfbgr
SHA256 ccfa2a67d01921867191fc088fd2e3c5c60209b1e6423e1586218d739f47a145
MD5 50cdf8376fd1df608f94a0acabe0fbba
SHA1 607cb371ca1fb8602c0b059ea9cfe61361a45fa7
SHA512 ed14a44f20a6776d58495268dc2ecf019eba55ce48e25faf8f5309429e33569a3cd4da4604b42d15280bcba60acb2f1d7dc37c7ea683f74a0164fa907df546bc
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	1408	WerFault.exe	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1408	SecuriteInfo.com.Variant.Lazy.232996.11026.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1372	1408	SecuriteInfo.com.Variant.Lazy.232996.11026.exe	26
PID 1408 wrote to memory of 1372	1408	SecuriteInfo.com.Variant.Lazy.232996.11026.exe	26
PID 1408 wrote to memory of 1372	1408	SecuriteInfo.com.Variant.Lazy.232996.11026.exe	26
PID 1408 wrote to memory of 1372	1408	SecuriteInfo.com.Variant.Lazy.232996.11026.exe	26

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.232996.11026.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.232996.11026.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 88
  2⤵
  - Program crash
  PID:1372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:608