9079f69a102da89d54f2732e5c13eb6a0cc47dd9d0603afef1040f2f8e1c69b5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 16:50

Target

2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe
Size

60KB
MD5

415586131c614888e0e3e5df0851dea4
SHA1

12da3fe660643d1001e5abc2a18ecb29f8bde213
SHA256

9079f69a102da89d54f2732e5c13eb6a0cc47dd9d0603afef1040f2f8e1c69b5
SHA512

2071eb64d2395df52839838ee7e3b8b75d7ff2bc908f1660ad4ac572aefc0f513888be92ec57db70efe36c835561832f0a8797259204f71c05b87e688047dc61
SSDEEP

384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26a3WDIRYpetOOtEvwDpjqIGRmd:6Qz7yVEhs9+4TR7tOOtEvwDpjL

Score

9^/10

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	1848	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2420	1848	2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe	28
PID 1848 wrote to memory of 2420	1848	2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe	28
PID 1848 wrote to memory of 2420	1848	2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe	28
PID 1848 wrote to memory of 2420	1848	2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_415586131c614888e0e3e5df0851dea4_cryptolocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 36
  2⤵
  - Program crash
  PID:2420

memory/1848-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download