04415c4746b7c85913c424ff1ea71ecf9bb3c42dcbd370742afc0420662492fe

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 00:31

Target

2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe
Size

116KB
MD5

414f91c122419b70e1f147766743e6de
SHA1

9f34a6caf3efd66408c405c8b86c58be9e52899f
SHA256

04415c4746b7c85913c424ff1ea71ecf9bb3c42dcbd370742afc0420662492fe
SHA512

eeeeb81d9eff95ce32fa594ccd6f2804824b214660ac866c468ac8122414974f8455181e3d2fade151c40e4ee94e64ed101adf60fd8a148f1bb356f7f8a0686d
SSDEEP

1536:KIlhrm++mJ0eYjT7LUrACph77pS2i/ICS4AcMvtshCaRzZOEJ21pRA:4fcrh7tJPvqhpZZOEj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2208	1932	2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe	28
PID 1932 wrote to memory of 2208	1932	2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe	28
PID 1932 wrote to memory of 2208	1932	2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe	28
PID 1932 wrote to memory of 2208	1932	2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_414f91c122419b70e1f147766743e6de_revil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 120
  2⤵
  - Program crash
  PID:2208