e97932b7420ce25630f778608a719f5d817291e779592756ba8374caa889fe9e

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 02:38

Target

2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe
Size

400KB
MD5

1fe85d3d3cfc03d37436fd13a9bb9f08
SHA1

cc03cbece8c26e05ea145cc9a79f3808d04c91a4
SHA256

e97932b7420ce25630f778608a719f5d817291e779592756ba8374caa889fe9e
SHA512

b4899c8e334e5160b48f7739f57a0f76c7ec041c3f0f658c8f6e5b6e2f2be7bf4656156801f7aaa686839b677b570d61f0c006905df28ad9ee07c9e3a0b61187
SSDEEP

6144:RbouacYxYvYiPLMNHu1f0eOAYPrQYmnBbYusk+a:5ouagDPgNHSwAYPene

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1716	2000	2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe	28
PID 2000 wrote to memory of 1716	2000	2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe	28
PID 2000 wrote to memory of 1716	2000	2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe	28
PID 2000 wrote to memory of 1716	2000	2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-19_1fe85d3d3cfc03d37436fd13a9bb9f08_kovter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:1716