5e7d5a25ef855a1fc79279e0eaf709452fda08cc6565017ae43783eb9c486fb9

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:27

Target

SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe
Size

588KB
MD5

4b4078cdaa30f07274767043a913bf0c
SHA1

40aa1020a1a2c53aba539332f25c281bd1d42e72
SHA256

5e7d5a25ef855a1fc79279e0eaf709452fda08cc6565017ae43783eb9c486fb9
SHA512

ad5034459c08e50c36130e6441a2eebb080a0a6a4c30ecbaa573fd449282e7261cc4349201d691b85cd9892c0a618de1a3046663aab7a483b332f9ca61bbe41e
SSDEEP

12288:3JVm5CPXs4dbqzy3r1CSmWHjjc7L2dptzrelRFP:5Vm5udbqzucSXH02dpt3sRh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 2316 WerFault.exe SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe

pid	pid_target	process	target process
2180	2316	WerFault.exe	SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe

description	pid	process	target process
PID 2316 wrote to memory of 2180	2316	SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe	WerFault.exe
PID 2316 wrote to memory of 2180	2316	SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe	WerFault.exe
PID 2316 wrote to memory of 2180	2316	SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe	WerFault.exe
PID 2316 wrote to memory of 2180	2316	SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.SuspectCRC.29256.3228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 36
2⤵
- Program crash
PID:2180