99a07ad565364572b9557e007554745bbccd07ea07a12feed3e21362f19a4262

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 02:33

Target

2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe
Size

191KB
MD5

ce48eca4368a5aff5464acc09357249d
SHA1

f6e72518a0041f935d9dfe4f5478bfb579823b01
SHA256

99a07ad565364572b9557e007554745bbccd07ea07a12feed3e21362f19a4262
SHA512

6d1feff9a5537f9f941df3b018dd4a6c2f2ddae0bc1dcba8ad145a27a1857b20e4ab8331770cb4ee75038fa74305ba7746c6c1c51b0efe72921a63057748a302
SSDEEP

3072:mx82LDL8ZRGd6zJfeQCsjYIBguCcvDtp9+kKyuil+b6K:mxLGGMzhksjY+DtP+xyD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2120	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2864	2120	2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe	28
PID 2120 wrote to memory of 2864	2120	2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe	28
PID 2120 wrote to memory of 2864	2120	2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe	28
PID 2120 wrote to memory of 2864	2120	2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_ce48eca4368a5aff5464acc09357249d_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 36
  2⤵
  - Program crash
  PID:2864

memory/2120-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download