5b3885296b3bf4ed6f8b99c135e1a08eb467da7e0b5e3fe2a052ebb08a048294

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 11:37

Target

SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe
Size

131KB
MD5

dd2bc19be3c355a34caa71c57441f92e
SHA1

2982803d47914739ab448a2b97391b317500e843
SHA256

5b3885296b3bf4ed6f8b99c135e1a08eb467da7e0b5e3fe2a052ebb08a048294
SHA512

85bed21c3bbd0086744ec6961a936357af75ac72dbaee5433da5fc02842767003d097650a0c4fc2d346b346ed4428541784b019520f6e51a8591d5131bbcaec6
SSDEEP

3072:h8/VApZl5zAahB52drrgaduBv85MTVd2sakX:h8szAu72drrgN3TP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	980	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 940	980	SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe	27
PID 980 wrote to memory of 940	980	SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe	27
PID 980 wrote to memory of 940	980	SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe	27
PID 980 wrote to memory of 940	980	SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.448962.19609.17054.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 156
  2⤵
  - Program crash
  PID:940