4fb86de07113a2b53448d5621dae4d2da70a3c36dff2089da50a1326eed99d8a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/09/2023, 01:37

Target
SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe
Size 702KB
Sample230912-b1tbhsce21
SHA256 4fb86de07113a2b53448d5621dae4d2da70a3c36dff2089da50a1326eed99d8a
MD5 d2e45174bc212793f36c5107b52e026d
SHA1 5333f2569ebc2c923ecc6d9cf8c012b6d70830a0
SHA512 ff6dfb0f6514a76533a0712186c6cc0397830267fe36f4c29d91f89a7a4b0cc5614dd3c46559e26ce3abc3496c1f9aec47a33483aa1a7ec56ffe4af912eabed6
SSDEEP 12288:KODphClGCxfAisF4JWM2XSUBIgnQG+isCyKCUt35dxC:KPEugnB+/Ul5dxC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2936	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	28
PID 3040 wrote to memory of 2936	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	28
PID 3040 wrote to memory of 2936	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	28
PID 3040 wrote to memory of 2936	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	28
PID 3040 wrote to memory of 2692	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	29
PID 3040 wrote to memory of 2692	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	29
PID 3040 wrote to memory of 2692	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	29
PID 3040 wrote to memory of 2692	3040	SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader46.2601.255.10572.exe"
  2⤵
  PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 620
  2⤵
  - Program crash
  PID:2692

memory/3040-0-0x0000000000FD0000-0x0000000001086000-memory.dmp

Download

memory/3040-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Download

memory/3040-2-0x0000000000AD0000-0x0000000000B2A000-memory.dmp

Download

memory/3040-3-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Download

memory/3040-4-0x0000000000390000-0x000000000039A000-memory.dmp

Download

memory/3040-5-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Download