20e6c4df837abecd50d42fc696714fcc3bb01b2d99fd448936f2c974e6f72637

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 19:11

Target

2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe
Size

111KB
MD5

da6920d243fba81af626e1798b7d2828
SHA1

5cf8d4c89596d650208361b679b079b4d54d67bc
SHA256

20e6c4df837abecd50d42fc696714fcc3bb01b2d99fd448936f2c974e6f72637
SHA512

6d37bda5af4576b97434db83eb9ec5c3dcc14f4efd52e09b4ddd47763d1d12c8f15655c7d329a2c90c9592946cd5288fa4e1b5a9718923bc286ce5c33165aefe
SSDEEP

1536:GGFsNB6w/NGe0gzbK0BVQI/GaOsa5L19CemCA5ridz/MxgY/jSwWuTs5gdUTPOGa:GG2r0gzbK00OGacsTSwWCagdUTmFmpm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	2328	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2348	2328	2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe	7
PID 2328 wrote to memory of 2348	2328	2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe	7
PID 2328 wrote to memory of 2348	2328	2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe	7
PID 2328 wrote to memory of 2348	2328	2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe	7

C:\Users\Admin\AppData\Local\Temp\2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_da6920d243fba81af626e1798b7d2828_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 36
  2⤵
  - Program crash
  PID:2348

memory/2328-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download