978fa8cba10976f558fcc00861a5146dff8abc58a63df5124541e444488e3d3e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 05:02

Target

2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe
Size

109KB
MD5

0eadd1b5932f31a650b5348a92a56f43
SHA1

0aa8d5f47aabb333148ccfd444e25bde3d1a61ef
SHA256

978fa8cba10976f558fcc00861a5146dff8abc58a63df5124541e444488e3d3e
SHA512

58d435b3771b5960c8527a64a75ed1743004e74c9ff1ded562c427cb80cd423a76bdafc6a6b86b50ce2bddd5b73551c3eda896d62f03fff8f4c314733b5eeb4e
SSDEEP

1536:Wvb3cGH976STD3jX8qlPHC+HxGlcaq3HPPFQR8h2PnxrvcBwCiF0MHTFoYr5Q9:+6SDDvlfCqu0P9Q2SxrvVyMHTFk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2184	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2248	2184	2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe	28
PID 2184 wrote to memory of 2248	2184	2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe	28
PID 2184 wrote to memory of 2248	2184	2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe	28
PID 2184 wrote to memory of 2248	2184	2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_0eadd1b5932f31a650b5348a92a56f43_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 36
  2⤵
  - Program crash
  PID:2248

memory/2184-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download