59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8

Analysis

max time kernel
130s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:22

Target

SecuriteInfo.com.Trojan.Mods.1.23576.17372.dll
Size

8KB
MD5

f0a6b858e457d67c77889834bb655948
SHA1

19af4fe16cc23a8f3cfc08e493454bbf3c1af5e3
SHA256

59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8
SHA512

e3bf170a2afa813fe6a2a24b48160b88056c4b0c9ff7a74cce118c8b89add2c47a2dd09867d33c10fa71b3017be9281f52016715a89755aa131b8aa63832e5ba
SSDEEP

192:3LFXpIUK5qKA2wOtN6KcVYwjcUFfxJl6AkJr4RFgcHtB:3XIUvKA27CKcVY2F5SvJrFcH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 4360 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1232	4360	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5052 wrote to memory of 4360	5052	rundll32.exe	rundll32.exe
PID 5052 wrote to memory of 4360	5052	rundll32.exe	rundll32.exe
PID 5052 wrote to memory of 4360	5052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mods.1.23576.17372.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mods.1.23576.17372.dll,#1
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 544
    3⤵
    - Program crash
    PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4360 -ip 4360
1⤵
PID:4552