4820c20fff437e3eac5ac91ea3d6afea08f7a8bc1d5e46eac34f589c69ce2b80

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 10:36

Target

SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe
Size

216KB
MD5

3c28255643dd5088198a42f13b36c2c1
SHA1

9f3ecfc697c63122617654556595ad03f5d9768b
SHA256

4820c20fff437e3eac5ac91ea3d6afea08f7a8bc1d5e46eac34f589c69ce2b80
SHA512

3e3f3e95903aed096925c0f0f36bdfa8c684ae30c1158c511e6ede842fed08776f2b4e231458d03ecf9403906c493ebf0a889ead452c2de0663a0791aa0a62b7
SSDEEP

384:E9bE2i/G+0PcM07fQPt9QAXqni8t5QrqUJgyBfRQEr4vBsLijSSrG8C8:Ex5iTecMoQPPQuItWrqUJgyrY8lU7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	1996	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2652	1996	SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe	28
PID 1996 wrote to memory of 2652	1996	SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe	28
PID 1996 wrote to memory of 2652	1996	SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe	28
PID 1996 wrote to memory of 2652	1996	SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12148.15052.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 36
  2⤵
  - Program crash
  PID:2652