f65d9d1ab35942996da83d04da6eb7be465ad11b4d111072f9019731bc161e84

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:24

Target

2024-08-29_db5ecf6fa872df9cbb4ac0356c76ba3f_avoslocker_hijackloader_metamorfo_revil.exe
Size

3.0MB
MD5

db5ecf6fa872df9cbb4ac0356c76ba3f
SHA1

fdddd34bea4e395e4574ce7ebd4acd35ccd890bc
SHA256

f65d9d1ab35942996da83d04da6eb7be465ad11b4d111072f9019731bc161e84
SHA512

b31a4d82ecdfb230d8028f0f3e439de19a30587134fc23c179e6aa1ab8fa69448e202e14dbb55036d376eeff0cd0a2763f781b074a01a99afd11218867bbedb3
SSDEEP

49152:66v7karQ6lGrG5D53IfhiOPUUdC3tPsbXC0iOvMm2FN2XoCYHgZQmF9C:66v7kwhGy5FIfgOMrybXEm2r2hC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	2156	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-08-29_db5ecf6fa872df9cbb4ac0356c76ba3f_avoslocker_hijackloader_metamorfo_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_db5ecf6fa872df9cbb4ac0356c76ba3f_avoslocker_hijackloader_metamorfo_revil.exe"
1⤵
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 432
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2156 -ip 2156
1⤵
PID:1700

memory/2156-0-0x00000000006D0000-0x0000000000A51000-memory.dmp

Filesize
3.5MB

Download
memory/2156-1-0x00000000006D0000-0x0000000000A51000-memory.dmp

Filesize
3.5MB

Download