375355c817bcaec1888ad5f9d7da32abaf23f9a116f481f01026356928ccf4cd

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 01:47

Target

2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe
Size

111KB
MD5

3aba5bc2ff0d219d798732af3dec3456
SHA1

03345aaec0a0f0f06baf10cd198e92b86717c42a
SHA256

375355c817bcaec1888ad5f9d7da32abaf23f9a116f481f01026356928ccf4cd
SHA512

bd4fafaa9ba503273467363da4f3ae335a84f41c8ecd9e7cee393a0c3d067407f127b694d4fda8d2577a0ebaf9546ac571ea38996fc8480b6df7dbe9719bccb9
SSDEEP

3072:pEuptAwkvaQ2rnI85l/910J1SICy2VYpT8R0:pEXwBrnbPhy2Vm8R0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	2372	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2348	2372	2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe	16
PID 2372 wrote to memory of 2348	2372	2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe	16
PID 2372 wrote to memory of 2348	2372	2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe	16
PID 2372 wrote to memory of 2348	2372	2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_3aba5bc2ff0d219d798732af3dec3456_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 36
  2⤵
  - Program crash
  PID:2348

memory/2372-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download