Analysis
- max time kernel
118s - max time network
135s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system - submitted
12/10/2023, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe
- Size 1.1MB
- Sample231012-zceefsdc44
- SHA256 e8c8adcc3b28d2fbf045214df0549ee9f0980954f4406f941c9e450a5f4e9111
- MD5 7a1dde0a1448a299b566b0987a893375
- SHA1 55da85aaaf0f14dd3289cad416520756b2010565
- SHA512 80cfc748a2fa41dbbb94fe8aca96d536733b911c3a31e56ca53ef12dc268ac901a612fa26c234a18c67d0b821259780826e03799a326522a1403f06b54149a8b
- SSDEEP 24576:TN4/qx4e1wW/E9L75i5u+y+AViaqnj8/m8ybhtQ:TT4e1wW/ALUkSTnj8/6hK
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1872 set thread context of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 - Program crash 2 IoCs
pid pid_target Process procid_target 2684 1872 WerFault.exe 27 2916 2272 WerFault.exe 31 - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2648 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 29 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2340 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 30 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2272 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 31 PID 1872 wrote to memory of 2684 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 32 PID 1872 wrote to memory of 2684 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 32 PID 1872 wrote to memory of 2684 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 32 PID 1872 wrote to memory of 2684 1872 SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe 32 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33 PID 2272 wrote to memory of 2916 2272 AppLaunch.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62396.26028.31908.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1963⤵
- Program crash
PID:2916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 722⤵
- Program crash
PID:2684
-