a3c87829ca6ad7f73efd714a3fc0f9d318703f848cee880693c283eec7155584

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:29

Target

2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe
Size

110KB
MD5

5ef6149e8003c90a6a4d65b1a8c1d690
SHA1

eec7ea9f2f65e12512f58cb3df61edf1bfbf0a9e
SHA256

a3c87829ca6ad7f73efd714a3fc0f9d318703f848cee880693c283eec7155584
SHA512

db6ede884cfaa91b394f3d4bbfe606605c4b75675c21c3176f4fb21a916e66c91f3c0533afd071db356fe389ca4351180a11b99b62bdbbb70715010d9c3bcf40
SSDEEP

3072:t3WU41cTYuPbeZh45iMzjxfrsBnhOD6FFodt:tmUyiY+bYhTMzjxfrqOWW3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 2364 WerFault.exe 2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe

pid	pid_target	process	target process
2192	2364	WerFault.exe	2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe

description	pid	process	target process
PID 2364 wrote to memory of 2192	2364	2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe	WerFault.exe
PID 2364 wrote to memory of 2192	2364	2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe	WerFault.exe
PID 2364 wrote to memory of 2192	2364	2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe	WerFault.exe
PID 2364 wrote to memory of 2192	2364	2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5ef6149e8003c90a6a4d65b1a8c1d690_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 36
2⤵
- Program crash
PID:2192

memory/2364-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download