fd37f992097f6d0686bf3d6cdecbfb6e3d60712eb6b6919459df1b1127e36edf

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 13:33

Target

SecuriteInfo.com.Win32.SpywareX-gen.30980.21719.dll
Size

5.3MB
MD5

eaef21fb8322000e736d7d877221ea50
SHA1

ed26426a164ff50563424658617a8330bb4c33a4
SHA256

fd37f992097f6d0686bf3d6cdecbfb6e3d60712eb6b6919459df1b1127e36edf
SHA512

129472311836e728205abb89cb12adb3a0ce3588a48927b173846196817d796be711eb2a14096a3480e0badbcbc2cc653e5141fd483fb34cbc7af9200276bfa9
SSDEEP

98304:YreJJkjylBVdBhgRNCd6qbtUNJhpFurD4pt:fzkOhrhaNJzn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	1680	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 2364 wrote to memory of 1680	2364	rundll32.exe	28
PID 1680 wrote to memory of 3020	1680	rundll32.exe	29
PID 1680 wrote to memory of 3020	1680	rundll32.exe	29
PID 1680 wrote to memory of 3020	1680	rundll32.exe	29
PID 1680 wrote to memory of 3020	1680	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.SpywareX-gen.30980.21719.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.SpywareX-gen.30980.21719.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 260
    3⤵
    - Program crash
    PID:3020

memory/1680-0-0x0000000073E60000-0x00000000743AF000-memory.dmp

Filesize
5.3MB

Download