bdaa5ac766346af920b279853a9e898d29461528f14a4c16b6ad8a64a814a4fa

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 02:31

Target

SecuriteInfo.com.Win64.DropperX-gen.15552.dll
Size

1.2MB
MD5

5e6c5a92b1621971e699fb0fe8852577
SHA1

877e8fe94eaa73d85c35544746c433fa392e4d86
SHA256

bdaa5ac766346af920b279853a9e898d29461528f14a4c16b6ad8a64a814a4fa
SHA512

88b4049af3dabe5f2f3946f67889a103cfd6cd46f3a8a1b9a8099df7017edade26c34ec0e0ecb60b110b1feb9f3ccd24d1450b113718c5524b27324b165d65ab
SSDEEP

24576:OSqXRxnyx/JQw1Gj4Q68Z9Op8Ve6V7dkiVEYJFqpQHTbBsrSOJra7M5oI:O5I3EU+sWVdV7dk6US4ag2I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	1636	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1868	1636	rundll32.exe	26
PID 1636 wrote to memory of 1868	1636	rundll32.exe	26
PID 1636 wrote to memory of 1868	1636	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.DropperX-gen.15552.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1636 -s 84
  2⤵
  - Program crash
  PID:1868