c368a84d0fe5fb7f2c8cbca5a995ec4e45f7bd71c980f0d34538e6b2814ce196

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/04/2023, 15:47

Target

SecuriteInfo.com.Trojan.Click3.30871.31421.exe
Size

1.5MB
MD5

2c4d825bfc57e8aa50a4cd65aded111e
SHA1

f094b7694e7cd63765a2f849594d1da93efc0127
SHA256

c368a84d0fe5fb7f2c8cbca5a995ec4e45f7bd71c980f0d34538e6b2814ce196
SHA512

39a8a55ece7064ac1e2701fe55bc0390403cb76e69553f44b18cd2633fec67fdb647ab88aee447b2e9348b028a068de0465f5a07f96a7a61838a2ad8a24a9e05
SSDEEP

24576:T0tvlcsyReCF9dgBgJKNul1RzVME6360jsbePn6G3sS:T0JlIZrgIL1CieP6E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2004	1232	SecuriteInfo.com.Trojan.Click3.30871.31421.exe	28
PID 1232 wrote to memory of 2004	1232	SecuriteInfo.com.Trojan.Click3.30871.31421.exe	28
PID 1232 wrote to memory of 2004	1232	SecuriteInfo.com.Trojan.Click3.30871.31421.exe	28
PID 1232 wrote to memory of 2004	1232	SecuriteInfo.com.Trojan.Click3.30871.31421.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click3.30871.31421.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click3.30871.31421.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 36
  2⤵
  - Program crash
  PID:2004