d7c2ea59900ee50294fe408409582dc95e4173e4fe35df58f5e484b80338241e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 06:06

Target

2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe
Size

116KB
MD5

dc0fdf4f7b9087decbc85222c8d3140d
SHA1

4bd3b2b27753ea30272b1af3ba3279b96210f8c8
SHA256

d7c2ea59900ee50294fe408409582dc95e4173e4fe35df58f5e484b80338241e
SHA512

25e3a41fd92a34996071827ffaff73fe430aefb5df170f1a74c5c8543bb918c45908edd01ad58420ab6bbf45d34a27145782c779d23e9a425f656b98a2a21941
SSDEEP

3072:TrQMrBpYujcAkU1qwTpBTaKK/2CNPPrHGQ:TrREG3k4baBj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1724	2756	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1724	2756	2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe	14
PID 2756 wrote to memory of 1724	2756	2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe	14
PID 2756 wrote to memory of 1724	2756	2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe	14
PID 2756 wrote to memory of 1724	2756	2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 36
1⤵
- Program crash
PID:1724

C:\Users\Admin\AppData\Local\Temp\2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_dc0fdf4f7b9087decbc85222c8d3140d_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

memory/2756-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download