531f72cada239184b1891aacddc6bd721008d7b1cc81b5fb715810f10bd82580

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 10:42

Target

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe
Size

112KB
MD5

4fb1dbc4a113a80d725fc13f9b1e3b73
SHA1

edaacd8d4062a579270bab5a4d4d8c9de05ce0ed
SHA256

531f72cada239184b1891aacddc6bd721008d7b1cc81b5fb715810f10bd82580
SHA512

dbd4340c82129e41ade79b69bf58b72a67594db65b3357e9112472db4731d77576a481806fc289cd66a1d0ed8aa2c876e6cb98a1a301b074e2297f93484b49e4
SSDEEP

1536:LbkwxIFPnbo0KNlMRUb7FnQHFWxxRV+mX7Hv2sHbUZ:LbkwCFPnc0KNlIUb7Fn/xxCmTfHoZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	2124	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1980	2124	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe	28
PID 2124 wrote to memory of 1980	2124	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe	28
PID 2124 wrote to memory of 1980	2124	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe	28
PID 2124 wrote to memory of 1980	2124	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15274.10444.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 36
  2⤵
  - Program crash
  PID:1980