77426ec69ec283fb561022e32c37768da6ae08e5ea24bb8aae134af971ded426

Analysis

max time kernel
93s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 11:21

Target

SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll
Size

9.2MB
MD5

2fd99904f95300a21658f7bdf37586cb
SHA1

75f61670c5b7c9469ebeac5e5047a410099a3468
SHA256

77426ec69ec283fb561022e32c37768da6ae08e5ea24bb8aae134af971ded426
SHA512

deb33d3f59627368ebbbb49e835d8eb31e1b771bdaa97801149830c9f0fdd5f617921238875c9d913a802274d21794812736b0f4205402c4a3d894deb04df7aa
SSDEEP

98304:pd1wcDirHdNJiJKm+wd20Q9e76Jf/5yjvm9HOcnkkkg7sQz8GeGv6y:pdKvfJic+/QC65/kjvm9Hkkkal9eMB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2472	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2472	4324	rundll32.exe	88
PID 4324 wrote to memory of 2472	4324	rundll32.exe	88
PID 4324 wrote to memory of 2472	4324	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Banker1.27846.8950.13243.dll,#1
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 760
    3⤵
    - Program crash
    PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2472 -ip 2472
1⤵
PID:1680

memory/2472-0-0x0000000002AE0000-0x000000000341E000-memory.dmp

Filesize
9.2MB

Download
memory/2472-1-0x0000000002AE0000-0x000000000341E000-memory.dmp

Filesize
9.2MB

Download