07e9541637e7b4bc31d5f27456fcdd77a0bf517b3b4df389875dd02d1fcd66ea

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:45

Target

kflr-olemissfan78.exe
Size

1.2MB
MD5

e8ff0427771136c79d18ebf529a45da8
SHA1

1e6e7eda7faf0825daa27e3b120bb187b10b37cf
SHA256

1965e5e028dbb05881af75d57970f034f531c656a1b4e967b3b36a8c721a99fd
SHA512

4b1d8c612996ddc40b6511f08f676739c2e10e94719c10eccc2c4f0cf17d7f7f4768f396534ffe27611763d4a04bc5192f0f1ecbec55b42602400df66ebd3672
SSDEEP

24576:gessPug4es1pq7yFO/qi/NXNfGCjSLmwsNPd3RgLJBV1Ls2wBPUU:RuxkyFO/jNd+CjS7sNlKLJBV1Ls2wBb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	1984	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2076	1984	kflr-olemissfan78.exe	23
PID 1984 wrote to memory of 2076	1984	kflr-olemissfan78.exe	23
PID 1984 wrote to memory of 2076	1984	kflr-olemissfan78.exe	23
PID 1984 wrote to memory of 2076	1984	kflr-olemissfan78.exe	23

C:\Users\Admin\AppData\Local\Temp\kflr-olemissfan78.exe
"C:\Users\Admin\AppData\Local\Temp\kflr-olemissfan78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 752
  2⤵
  - Program crash
  PID:2076