881cfae1ae88de7cd88f87fa2c2d7aeff02ab8f3d2c7381d000cd9097e71b196

Analysis

max time kernel
35s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 14:31

Target

SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe
Size

444KB
MD5

4119ce4cfd3874a04575d0147614ec77
SHA1

edb660a647b5e7c736aa0b8151b19ff300d3fdd9
SHA256

881cfae1ae88de7cd88f87fa2c2d7aeff02ab8f3d2c7381d000cd9097e71b196
SHA512

36524564ea475e0c6b0345a1664997669d19b3907443195a42527721340ee8ab3a4bbd4d7ee9169228bef6f6747f2d2f65aea0305d27dd7bc7dace92a3257dbf
SSDEEP

6144:/3I4oKkdQlULYvLLWqY3FAssinEeOgmczeOmM3rdNwgLrlCfnEnsGAc82Hn0QIb:+KkMFLmes2OzvmM3Lwg/4fEnJg2H

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1604 836 WerFault.exe SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe

pid	pid_target	process	target process
1604	836	WerFault.exe	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe

description	pid	process	target process
PID 836 wrote to memory of 1604	836	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe	WerFault.exe
PID 836 wrote to memory of 1604	836	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe	WerFault.exe
PID 836 wrote to memory of 1604	836	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.29075.6786.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 836 -s 520
2⤵
- Program crash
PID:1604

memory/836-54-0x0000000000AC0000-0x0000000000B34000-memory.dmp

Filesize
464KB

Download
memory/1604-55-0x0000000000000000-mapping.dmp

Download