36a7d26e3207335847c8092b8f1d194519f32ef595a1b5e5bda80cd727a95499

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 12:37

Target

9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe
Size

182KB
MD5

9eec9155b7dfa5e8589d769618c8a8df
SHA1

a7c23ba0c203cec8f738f462a4ef6690dace0807
SHA256

36a7d26e3207335847c8092b8f1d194519f32ef595a1b5e5bda80cd727a95499
SHA512

a85395e39b4853b98245b6119d64ff9823bd56783597fbbb13ddc0fb4a197769ec88888bfeec0efa829b4158b1abb5760a81f3515bcc9ac1590dd3cd878143f8
SSDEEP

3072:byoIMo9Y4Rl9Qt5+zC0hYk2W2wahP8X2oWb13hyjJ280YX9n0qF52m9lcIskUe:WoIM+ROB0hYBD803h+0YXVcm9r9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 756	772	9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe	28
PID 772 wrote to memory of 756	772	9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe	28
PID 772 wrote to memory of 756	772	9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe	28
PID 772 wrote to memory of 756	772	9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9eec9155b7dfa5e8589d769618c8a8df_virlock_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 36
  2⤵
  - Program crash
  PID:756

memory/772-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download