a1d7506eebfdd6b2d2e599ee30a84f76dc41ea6261a6e1d92ffe31e224b1aaf1

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2023, 15:35

Target

SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.25048.23140.dll
Size

24KB
MD5

2688c8f8643dd1d498e9a52115515115
SHA1

1a8f8d6c3855c9ecd7942a69c2d68a5bd939cfbf
SHA256

a1d7506eebfdd6b2d2e599ee30a84f76dc41ea6261a6e1d92ffe31e224b1aaf1
SHA512

18639569c2f3feb1540c9c78214b30d83918c4e5b12a681369848e696e0afc628e721ef288057ce942de23c020b368dd3df6680a53cb1c727688d3bd83b1503f
SSDEEP

48:gxKQ7xg/9XtAmQqmpinW5gOMzlD2GDDwi10eZC2X7FDJVmcxvsJs0s38JQq/ZPsX:Ys/FmInW5r2X0aXHI1TB2w5E5BBG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3328	2672	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2672	1120	rundll32.exe	82
PID 1120 wrote to memory of 2672	1120	rundll32.exe	82
PID 1120 wrote to memory of 2672	1120	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.25048.23140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.25048.23140.dll,#1
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 544
    3⤵
    - Program crash
    PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2672 -ip 2672
1⤵
PID:4868