a5c2b18cb765726b1cfaaed30bce6cb8a34da6ddb7c3b3fe52f0a21235b9675f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:25

Target

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe
Size

148KB
MD5

21e607a621c1d322ec989b1af7bb6b9e
SHA1

3540cb4f339ea6b71fadce766191babcc979bb5c
SHA256

a5c2b18cb765726b1cfaaed30bce6cb8a34da6ddb7c3b3fe52f0a21235b9675f
SHA512

d6e0a3789e27b94e692f6607b05ddb47810e5e774876077e4480fe9a4255629a44ad557d49cbb8a471e1697fcf81c631901dff8dd77daf98bca5cd11e6fab1f3
SSDEEP

768:qcDwwwwwwBwwwwwwwmyYGcvFWW8bZDOpaY7Z4KFj5bge0Wem0gOBKFNc0l8QE/Yc:qJtbz6yYB8u7E2YmuTTQDeeXUpksR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	840	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2244	840	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe	28
PID 840 wrote to memory of 2244	840	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe	28
PID 840 wrote to memory of 2244	840	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe	28
PID 840 wrote to memory of 2244	840	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 36
  2⤵
  - Program crash
  PID:2244