acf4e311f057196e4fad70b176c253088509e73807e62415267771a9843b7021

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 09:23

Target

2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe
Size

166KB
MD5

0c68f98b2fd4ef67ca840498db640f71
SHA1

3418b672b76a2fc662fb7e726a00d02aaca58570
SHA256

acf4e311f057196e4fad70b176c253088509e73807e62415267771a9843b7021
SHA512

06de6a0a693d7b14cfca267ca93387e1090c01c15f2753a9d1ef4607eaca77c82f7b57c9c53c16a7c2d8dac86670e4fb206fb1d0eda0a567b6f0073388b4f18a
SSDEEP

3072:CLFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgyMT3QgerRJN+tH:0J0BXScFy2RsQJ8VggerJM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	1696	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2100	1696	2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe	28
PID 1696 wrote to memory of 2100	1696	2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe	28
PID 1696 wrote to memory of 2100	1696	2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe	28
PID 1696 wrote to memory of 2100	1696	2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_0c68f98b2fd4ef67ca840498db640f71_revil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36
  2⤵
  - Program crash
  PID:2100