77426ec69ec283fb561022e32c37768da6ae08e5ea24bb8aae134af971ded426

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 11:21

Target

SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll
Size

9.2MB
MD5

2fd99904f95300a21658f7bdf37586cb
SHA1

75f61670c5b7c9469ebeac5e5047a410099a3468
SHA256

77426ec69ec283fb561022e32c37768da6ae08e5ea24bb8aae134af971ded426
SHA512

deb33d3f59627368ebbbb49e835d8eb31e1b771bdaa97801149830c9f0fdd5f617921238875c9d913a802274d21794812736b0f4205402c4a3d894deb04df7aa
SSDEEP

98304:pd1wcDirHdNJiJKm+wd20Q9e76Jf/5yjvm9HOcnkkkg7sQz8GeGv6y:pdKvfJic+/QC65/kjvm9Hkkkal9eMB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2444	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2428 wrote to memory of 2444	2428	rundll32.exe	28
PID 2444 wrote to memory of 2460	2444	rundll32.exe	29
PID 2444 wrote to memory of 2460	2444	rundll32.exe	29
PID 2444 wrote to memory of 2460	2444	rundll32.exe	29
PID 2444 wrote to memory of 2460	2444	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 300
    3⤵
    - Program crash
    PID:2460

memory/2444-0-0x0000000002060000-0x000000000299E000-memory.dmp

Filesize
9.2MB

Download
memory/2444-1-0x0000000002060000-0x000000000299E000-memory.dmp

Filesize
9.2MB

Download