382f78cc7b5970bac034fa49168ac1f18a2859b1eb193910c649222209301458

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 04:18

Target

2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe
Size

44KB
MD5

c8e3adeae74f4b69c4ad762e84035901
SHA1

51d36e153837380125a903cc4fbd3810a6c5170f
SHA256

382f78cc7b5970bac034fa49168ac1f18a2859b1eb193910c649222209301458
SHA512

313cacff80b839c7aae972b15699aa83be53b989c9508b5c1ad94d08226526c67123fa0c31c63a161e9e29313ca42d6db9d7bfa5f510b175fe3d8b658ab7f97c
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1ws8:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1u

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-14.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1948	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1572	2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1948	1572	2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe	28
PID 1572 wrote to memory of 1948	1572	2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe	28
PID 1572 wrote to memory of 1948	1572	2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe	28
PID 1572 wrote to memory of 1948	1572	2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_c8e3adeae74f4b69c4ad762e84035901_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1948

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
d73638fa94a30b5ffd0b2ee686915d94

SHA1
c04598f090f21d372dc2e20a9ab2ca770671190f

SHA256
797d9849cfd3e5cc520cce96a0e6dfb44169c407557e4ce2d176dbd9110fb11a

SHA512
7eeb4d9947d0a1beb8a81c809980586cd16f66d4025f1c8145686c04314d7e448dcf462750c343f26b470efcc037aa735c793496cdd132072a6cd69938d09681

Download Submit
memory/1572-1-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1572-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1572-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1572-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1948-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download