9b752fc57f6cd1b2f7869f232c6860adf24bcc3454d330e9f481671b27b7dc0c

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 04:32

Target

SecuriteInfo.com.Win64.Evo-gen.23783.exe
Size

481KB
MD5

fe9ba4720007e83dce56fc48db01714e
SHA1

22001f0203006ea0ca3770b4f9e7a623b7508e4f
SHA256

9b752fc57f6cd1b2f7869f232c6860adf24bcc3454d330e9f481671b27b7dc0c
SHA512

400d399fc8a1296d02f6828d94a2b4ca98752fabe3940fe0673790f39271a0f119e3684fdfdb95e7045379247a0afdd719eb5d79d83d76846cdf062d0be1163a
SSDEEP

12288:+9N5ED78SX7p+yqWmg1VvagwxOVKTa/qo6b82q3AM0Yn6fEa:+9UMg1+yqkvagfVKTORNhx0Yn6c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1144 1920 WerFault.exe SecuriteInfo.com.Win64.Evo-gen.23783.exe

pid	pid_target	process	target process
1144	1920	WerFault.exe	SecuriteInfo.com.Win64.Evo-gen.23783.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Win64.Evo-gen.23783.exe

description	pid	process	target process
PID 1920 wrote to memory of 1144	1920	SecuriteInfo.com.Win64.Evo-gen.23783.exe	WerFault.exe
PID 1920 wrote to memory of 1144	1920	SecuriteInfo.com.Win64.Evo-gen.23783.exe	WerFault.exe
PID 1920 wrote to memory of 1144	1920	SecuriteInfo.com.Win64.Evo-gen.23783.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.23783.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.23783.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1920 -s 520
2⤵
- Program crash
PID:1144

memory/1144-55-0x0000000000000000-mapping.dmp

Download
memory/1920-54-0x0000000000140000-0x00000000001BC000-memory.dmp

Filesize
496KB

Download