3f2ed14209d2cd6eb55501035e8e826963552ea1bf144caf94fcfd68d1b50c61

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 10:31

Target

SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe
Size

479KB
MD5

2406134c26710d9cbd8a23f7dab65d19
SHA1

6c7568146f472a366f33ac8e96a05693b8dd1a74
SHA256

3f2ed14209d2cd6eb55501035e8e826963552ea1bf144caf94fcfd68d1b50c61
SHA512

240def0da376597499254ba564a11105034be31521c89a60e3304b30915e8ecd527d8ef546336585a6c3143e8ca9d9c290bb209a89881f4e457d8df1c958f020
SSDEEP

6144:wVq6Yi1QlYbqY00eu0XcSmYFevvW21QMHbxBMHnvU1D7OOP7NVZjrfQDS96hf+U8:AFLfcTcnW2Z9b1HOOP7Rr6hGU/E1U

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 1604 WerFault.exe SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe

pid	pid_target	process	target process
1668	1604	WerFault.exe	SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe

description	pid	process	target process
PID 1604 wrote to memory of 1668	1604	SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe	WerFault.exe
PID 1604 wrote to memory of 1668	1604	SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe	WerFault.exe
PID 1604 wrote to memory of 1668	1604	SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1604 -s 520
2⤵
- Program crash
PID:1668

memory/1604-54-0x0000000000A40000-0x0000000000ABC000-memory.dmp

Filesize
496KB

Download
memory/1668-55-0x0000000000000000-mapping.dmp

Download