8e578257277fb1423a49a1e0572b7f8eeaf5e1312c68209364b4273bc0c3c9f2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
12-11-2023 13:24

Target

SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe
Size

2.0MB
MD5

3cb9efe410a2ae4089859816ecf563c9
SHA1

23c6eec3f1f064d4bde8342c7489af2c770ce743
SHA256

8e578257277fb1423a49a1e0572b7f8eeaf5e1312c68209364b4273bc0c3c9f2
SHA512

a3973fbfe5a8584ecb4ce61038a4e05ed62c721136aa59ff8226b696d2f10cf8a848f2d3d8252aba57c225da3da88627e31adc2f266582e99b38129696150df2
SSDEEP

24576:DYW3Fm75rdcG3OHmmH5IPbKSPVE5WVKuGc6jE0wprct:DY6SrgHjQKS+WVKuGc6jEs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2928	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2940	2928	SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe	28
PID 2928 wrote to memory of 2940	2928	SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe	28
PID 2928 wrote to memory of 2940	2928	SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe	28
PID 2928 wrote to memory of 2940	2928	SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
  2⤵
  - Program crash
  PID:2940