173ca903813ebb504f3627218dffda310b310ff273eacc0e725507221a50b0cb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:30

Target

2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe
Size

110KB
MD5

d6ac9a53e8989b2a320323c3cbe3ebbd
SHA1

5eeb80fa4d1e01577e70f854c62fad9556294eaf
SHA256

173ca903813ebb504f3627218dffda310b310ff273eacc0e725507221a50b0cb
SHA512

352d7b1a6f11617ca6470b4168c6fa428deff7f5c8e45287c64add6c62e7e6a2df9c9b4968dd8e5f812bfeb400c399583324878bc6fbcece39fc10cc61becb5f
SSDEEP

3072:8o8hf71WVFm1VHkgU+4pChwgONPiyjN0xc0Ezp:Yh4g6WwgoPisGu0EV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2992 2932 WerFault.exe 2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe

pid	pid_target	process	target process
2992	2932	WerFault.exe	2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe

description	pid	process	target process
PID 2932 wrote to memory of 2992	2932	2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe	WerFault.exe
PID 2932 wrote to memory of 2992	2932	2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe	WerFault.exe
PID 2932 wrote to memory of 2992	2932	2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe	WerFault.exe
PID 2932 wrote to memory of 2992	2932	2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d6ac9a53e8989b2a320323c3cbe3ebbd_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 36
2⤵
- Program crash
PID:2992

memory/2932-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download