4145e05bfadf920ee629ad30a73ce27c5efbf0a5b01f486568060897b645569a

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 05:36

Target

2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe
Size

110KB
MD5

6a4007f40ca3844ede19bb5bbee7bf28
SHA1

701ce395a5b9958f7793c3e240ae245ead4cfe4c
SHA256

4145e05bfadf920ee629ad30a73ce27c5efbf0a5b01f486568060897b645569a
SHA512

9b853ee463751e7c78427e94e8d64b174c54a16e29394f7d36965df2adce749ffe5854d360c344d0ea2de5bd0a3e60d7008bcbdea609d3ba77311c76777dcab1
SSDEEP

1536:10hjZzn3sVf0rIAoFigINsb1mSK52yxtmGO7ANPW68x+gDui4i42LFqzjLOBp3EG:cj3sVMoY81mZ525DsNPXU1C2LCLKlt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	2260	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1600	2260	2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe	28
PID 2260 wrote to memory of 1600	2260	2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe	28
PID 2260 wrote to memory of 1600	2260	2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe	28
PID 2260 wrote to memory of 1600	2260	2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_6a4007f40ca3844ede19bb5bbee7bf28_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 36
  2⤵
  - Program crash
  PID:1600

memory/2260-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download