30e9e1400490475e50b3c0d2078a6082e1ac1302c502083de18e6f9c6fbff4a7

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/09/2022, 09:16

Target

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe
Size

1.0MB
MD5

ebc09e43954886dee2a034fa9a04f3e6
SHA1

998d4e00295d31cc73fb18f04d263f29ffba70a5
SHA256

30e9e1400490475e50b3c0d2078a6082e1ac1302c502083de18e6f9c6fbff4a7
SHA512

34199dc163c15565967535d294212c9fe4b9f2d3d944ff884f73e133a2e8c745fcf90ef51c6429d011a0547bd941975fbf29bcb97e081eb06f7a27d3321de4c1
SSDEEP

12288:Fo3WppP+GvQE35vE99HkfNULsAYh7IO17SPXjHzZ:Fo3WnvQMNUQIO17wh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1016	1972	SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe	28
PID 1972 wrote to memory of 1016	1972	SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe	28
PID 1972 wrote to memory of 1016	1972	SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe	28
PID 1972 wrote to memory of 1016	1972	SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Trojan.VORE-2106.1542.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 36
  2⤵
  - Program crash
  PID:1016