26af2fe49e2a711fbaaff3d5b604be55e5b4969c08d7a12661866482882072f5

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29-09-2023 22:31

Target

SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe
Size

1.2MB
MD5

dd2d1046abcfa995fef33b1786b05f2a
SHA1

0e2987c3b17020e3fbfef22ebed67f5d3132707d
SHA256

26af2fe49e2a711fbaaff3d5b604be55e5b4969c08d7a12661866482882072f5
SHA512

34318f740fe99bfd7d8b711760b0802a5a6b0239f30c86ae145a5e17c78ef51eccb59f4511fec78c1d83d920991219a64e20494290265b7b15225ec97bc505f2
SSDEEP

24576:22GqTi7qvyP0Z+BSSHVws+hVWP+ZvmQivu65Za0/ft:ZqcSHVihVaeivh5X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3048	3028	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe	1
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe	1
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe	1
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
1⤵
- Program crash
PID:3048

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Delf-THP.8429.2070.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028