6cee80f3c536692c50cc78f18a2544664d53bb9b8acb6af6e449203b36e6c4c3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 14:15

Target

2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe
Size

904KB
MD5

b5ce4a8ab3269c3eadcdd9e7c6278e2f
SHA1

c9996cd1920957cf140f07c756c09fab82bc368a
SHA256

6cee80f3c536692c50cc78f18a2544664d53bb9b8acb6af6e449203b36e6c4c3
SHA512

77ba5f4161031897dbb218d44cd34ebb2fccecf4a092eeed520f9d8aea01945c164de612ea3bc6b933f86d00a7ad96a213439dff09c5dacbeddff3345983f488
SSDEEP

24576:AABmKtS7W4FaulPf4nyJzrS9Ypr5SV1y5QZK7ZjE5Tj+XcNpyOvjZLS4:AABmpEulPwnyJD2gOvjZLS4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2084	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2100	2084	2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe	28
PID 2084 wrote to memory of 2100	2084	2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe	28
PID 2084 wrote to memory of 2100	2084	2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe	28
PID 2084 wrote to memory of 2100	2084	2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_b5ce4a8ab3269c3eadcdd9e7c6278e2f_bkransomware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 216
  2⤵
  - Program crash
  PID:2100