dc5b8092604f31d50320fc52c576cc49f433bcdd85b43b5848e8d7b622ea54d0

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 10:26

Target

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe
Size

1.2MB
MD5

5cfbf57bfcc735432c0266a0859e02b0
SHA1

4d62d69012f34aef81a54d9661b739934905c40a
SHA256

dc5b8092604f31d50320fc52c576cc49f433bcdd85b43b5848e8d7b622ea54d0
SHA512

513181166ba94420c5240d0539d0ad74b91ea8f3a9dcaf63f9664ece8c42dbdda6c2a610e798a2bde16b63b3b2124cd8d1e4b6715caf7217a8d8d7389bed5a83
SSDEEP

12288:2HWeU+8aruYcpgrzJ7yHUG43U4ChRicjhIjdMJhE+PBFPcuDDPzlkxTi3aYPbP88:22eU+8aruYcpgrw0Hk4DddszDDPzrAs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	1540	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 380	1540	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe	28
PID 1540 wrote to memory of 380	1540	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe	28
PID 1540 wrote to memory of 380	1540	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe	28
PID 1540 wrote to memory of 380	1540	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2833.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 36
  2⤵
  - Program crash
  PID:380