619c94c7bf1d58a9d2c57e7e74b1db77aa19cf03f18c765ebbd129c9d9faa090

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 17:41

Target

klcsldcl.exe
Size

180KB
MD5

4f60488f59a4dbe4251d9d0b89ef46ed
SHA1

9635a9d68286b0a74aaa0d9fa0b84a454caabe65
SHA256

619c94c7bf1d58a9d2c57e7e74b1db77aa19cf03f18c765ebbd129c9d9faa090
SHA512

98b89461087f03199af53f5c30ff7bef7ed5d02dff9b79e815f538378098eb91667f44edb811228a69fcdc8c64848c246455aff5f1a22e7b5dfbaa380c937948
SSDEEP

3072:wfnuq6vMByOS1dgUTTwCSYVAgkUN3MCjbjYqfSaYc43ToXDKzqSkpolk/+dU7w:w/uq6UByOS1dRTcWAgnNjbnf1zKzqSkc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	2144	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1912	2144	klcsldcl.exe	28
PID 2144 wrote to memory of 1912	2144	klcsldcl.exe	28
PID 2144 wrote to memory of 1912	2144	klcsldcl.exe	28
PID 2144 wrote to memory of 1912	2144	klcsldcl.exe	28

C:\Users\Admin\AppData\Local\Temp\klcsldcl.exe
"C:\Users\Admin\AppData\Local\Temp\klcsldcl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 72
  2⤵
  - Program crash
  PID:1912