f90c0e62193b73e8c728c020170b4bf3009a771e518500bd7f308a68ef4fecc7

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:33

Target

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe
Size

128KB
MD5

35001695a6091a546ad80dd9b34ad6d5
SHA1

22341169dbe0c9342b29de32486cc504c18c86fb
SHA256

f90c0e62193b73e8c728c020170b4bf3009a771e518500bd7f308a68ef4fecc7
SHA512

55e331744498e9ca2726b105dc07b150ec1d2c03d1d7e2a4d83eb3ac78355160e72cd9e9e7bfaeeb5362a674c7f7d929521f05602477e4bcdf3babe38c49d064
SSDEEP

1536:4X0ALOINwTUV/acvvta3RRZubZYwfEHMieXY8hpwsuClOAqI5ZTJ5Ftz8YJJja:LlINka8NAuwfEHMTLZTa

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2288 2264 WerFault.exe SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe

pid	pid_target	process	target process
2288	2264	WerFault.exe	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe

description	pid	process	target process
PID 2264 wrote to memory of 2288	2264	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe	WerFault.exe
PID 2264 wrote to memory of 2288	2264	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe	WerFault.exe
PID 2264 wrote to memory of 2288	2264	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe	WerFault.exe
PID 2264 wrote to memory of 2288	2264	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23237.32291.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 36
2⤵
- Program crash
PID:2288