c352dd8022d018a4e5a840d02744a8496ea2a09b8838aa941bbd3ea435513354

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:34

Target

SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe
Size

30KB
MD5

b9138849cf942ae6c662c60c22d55cb0
SHA1

25bb91046cd7c89862b87723d67be980e2957ce7
SHA256

c352dd8022d018a4e5a840d02744a8496ea2a09b8838aa941bbd3ea435513354
SHA512

bec5d64159ebed6864c040c2ee951c423112a5d296673812c27a17baca27d308e7a7eec708d5a3b90d27ac2b708b6176f7a60b29d0b9efb061c681a8d7d7c534
SSDEEP

768:qt9PEICYxid9LUguy+ezKLn2KA47PCMCAu:uCkiHUguylICcu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 692 WerFault.exe SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe

pid	pid_target	process	target process
1260	692	WerFault.exe	SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe

description	pid	process	target process
PID 692 wrote to memory of 1260	692	SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe	WerFault.exe
PID 692 wrote to memory of 1260	692	SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe	WerFault.exe
PID 692 wrote to memory of 1260	692	SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe	WerFault.exe
PID 692 wrote to memory of 1260	692	SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.17711.30807.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 200
2⤵
- Program crash
PID:1260

memory/692-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1260-56-0x0000000000000000-mapping.dmp

Download