4872c5fa8fe85d75538d00f56a6bc94801f77c7bf217ec69a41d9f9937b7652a | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/05/2023, 12:30

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Crypt.6469.12502.exe
Size

700KB
MD5

e16e51b1dd6051b2617e7aad678142b8
SHA1

4e1289a2958b6b32c90bee3e7afaa21d331e76ac
SHA256

4872c5fa8fe85d75538d00f56a6bc94801f77c7bf217ec69a41d9f9937b7652a
SHA512

78724c8b9c1b17372556b1260e57d5e9a89529721e7bd15af88f77a5f1d2e629a42a8253f01e0e7fa55a8d5998541c6133662958c258b3845f79cd1167a67355
SSDEEP

12288:I8WHr+sPyWWbj3aJdWEG3qerC94rchMv:I8rWWKJdW4OKg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1932	1936	SecuriteInfo.com.Trojan.Crypt.6469.12502.exe	28
PID 1936 wrote to memory of 1932	1936	SecuriteInfo.com.Trojan.Crypt.6469.12502.exe	28
PID 1936 wrote to memory of 1932	1936	SecuriteInfo.com.Trojan.Crypt.6469.12502.exe	28
PID 1936 wrote to memory of 1932	1936	SecuriteInfo.com.Trojan.Crypt.6469.12502.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Crypt.6469.12502.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Crypt.6469.12502.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 36
  2⤵
  - Program crash
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads