eeef52701956cc860771ef368589e3590a1e55a172910fb7b02950a5f9a06a9e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
26-09-2023 10:41

Target

SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
Size

320KB
MD5

ee3ba73a32711562903523726ba2df7c
SHA1

aa3927a92d75cae9b60740ac656a7944709d139b
SHA256

eeef52701956cc860771ef368589e3590a1e55a172910fb7b02950a5f9a06a9e
SHA512

2fda0a7b8f35d73a209b796c1bb68f0437e2d066dbaa7bcab24ced914250a7ef3e15b67ed88a1b62714d5d9d5ec2f7f2ac593bb3c849f22bb75872b317183943
SSDEEP

6144:krguHQQbURQH4SAislYsk1uU9pqZ+MiHk+xujrKO7I:krguH/URQYSAisl1klu1+8XKC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2112 2364 WerFault.exe SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe

pid	pid_target	process	target process
2112	2364	WerFault.exe	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe

description	pid	process	target process
PID 2364 wrote to memory of 1504	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
PID 2364 wrote to memory of 1504	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
PID 2364 wrote to memory of 1504	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
PID 2364 wrote to memory of 1504	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
PID 2364 wrote to memory of 2112	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	WerFault.exe
PID 2364 wrote to memory of 2112	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	WerFault.exe
PID 2364 wrote to memory of 2112	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	WerFault.exe
PID 2364 wrote to memory of 2112	2364	SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.16056.29351.exe"
2⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 620
2⤵
- Program crash
PID:2112

memory/2364-0-0x0000000000A40000-0x0000000000A96000-memory.dmp

Filesize
344KB

Download
memory/2364-1-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-2-0x0000000000390000-0x00000000003CE000-memory.dmp

Filesize
248KB

Download
memory/2364-3-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download
memory/2364-4-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/2364-5-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-6-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download