86f21bc5cf13abdf7ad947f512d7437128b9dfc5dc9bdea72aa3ff9b83c3b317

Analysis

max time kernel
139s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 05:31

Target

2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe
Size

110KB
MD5

dd153930063a0d25922948658a6ac539
SHA1

f1b7ebc177d943c319d9d64a14d5d4aecf1b25c2
SHA256

86f21bc5cf13abdf7ad947f512d7437128b9dfc5dc9bdea72aa3ff9b83c3b317
SHA512

867fd7c63b7d13448fc4beb15c813e586c43d2b64bf6da44f9d0fa082d5b9aab4c96777d4be5d9f4b1776c2d6c2b04627d08905db9afceb87dbafa41c8037789
SSDEEP

3072:K1347hLu3JBYkauQ3KzojrcjvsaOskv1hs2VEVAPVpVNyNi7HNSNtNeNrvUNDUN1:Oo7hLu3jouQ3K+xMZ+Az

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3224	3652	WerFault.exe	95
4332	3652	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 3224	3652	2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe	99
PID 3652 wrote to memory of 3224	3652	2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe	99
PID 3652 wrote to memory of 3224	3652	2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-29_dd153930063a0d25922948658a6ac539_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 224
  2⤵
  - Program crash
  PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 224
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3652 -ip 3652
1⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3668 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2004

memory/3652-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3652-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download