d6b143462d6f5ccfe3766130dd4fb12189387ba568186152f797ed97124c4c8a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:27

Target

SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe
Size

1.2MB
MD5

59442f91e6112c5565f7e77594ff3673
SHA1

4ecc9ee2828a862217bdb3ad913abecd44b61fff
SHA256

d6b143462d6f5ccfe3766130dd4fb12189387ba568186152f797ed97124c4c8a
SHA512

fc27e2cdacb24887444ccbc65cdacef9940d527c7a53d1b6320fc574dc1e46b45577f1edda59e638153881b8675b00ff2e20a39fd80588553cf16202134f9c27
SSDEEP

12288:8JjD3HjEycZ22hPnFxKmdDdzH7Y4F52+McZ87jLhOr:8JjDNc00nFxzdhzHU432+5ZoLhO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 1304 WerFault.exe SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe

pid	pid_target	process	target process
1680	1304	WerFault.exe	SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe

description	pid	process	target process
PID 1304 wrote to memory of 1680	1304	SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe	WerFault.exe
PID 1304 wrote to memory of 1680	1304	SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe	WerFault.exe
PID 1304 wrote to memory of 1680	1304	SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe	WerFault.exe
PID 1304 wrote to memory of 1680	1304	SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.30685.29503.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 36
2⤵
- Program crash
PID:1680