38ddef65caed8667cf609413b6f3c6722542239fd6c8e2ce6fb9cc43a2a3ef0e

Analysis

max time kernel
128s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 13:30

Target

SecuriteInfo.com.Trojan.Click2.55197.9468.dll
Size

1.8MB
MD5

3175c40ff0c5b9d7346ac0f3772dfaa2
SHA1

06eeb3f63b5a16e7fdf41c0d17869c2657fd622b
SHA256

38ddef65caed8667cf609413b6f3c6722542239fd6c8e2ce6fb9cc43a2a3ef0e
SHA512

b8dcf3a81baf7a446f748b88edb723b624ecbe930dbff2cb359d6e641e985ff1b76f0286f0307f371b775b3b91f412097dfed666a57cb54de0ceb3bcfea65dd9
SSDEEP

24576:V9ah+UklQtDMSnx21r8bwTjuWrDU4Ag+aDq4Ue764d5G+ZU5s8tbsodiwKUSVQxN:V97UIUgSnx21rLdDMw5G+yftXFFOvNo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	3252	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3252	228	rundll32.exe	84
PID 228 wrote to memory of 3252	228	rundll32.exe	84
PID 228 wrote to memory of 3252	228	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click2.55197.9468.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click2.55197.9468.dll,#1
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 544
    3⤵
    - Program crash
    PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3252 -ip 3252
1⤵
PID:4372