ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 17:20

Target

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe
Size

2.2MB
MD5

815968c1e37397cea2bdb59e495302e5
SHA1

5685534a64708ff79755b6567fb144f97582fbbe
SHA256

ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15
SHA512

b8ebc84c5165008161aa7aec8671754cac116f8d15e8fda087ed63b67dc75b0b4e40d76b4aba3d53a150f18ed1c3bdd00f7f1bc669533ee25cb9e630a9b37c95
SSDEEP

24576:Jkpxqh7TXAQAbg82Xbvue836blvPuA9xG0bTd2jBx024soFgXEqXw04Xw+z9jVQw:y0hXA282XKeCuiJ4soFgXEqXw0GV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2604	2896	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe	29
PID 2896 wrote to memory of 2604	2896	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe	29
PID 2896 wrote to memory of 2604	2896	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe	29
PID 2896 wrote to memory of 2604	2896	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2202.7629.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 48
  2⤵
  - Program crash
  PID:2604