c1bfb2bf8a20867aca636033637eec9ff0a021037c36466c12cb40f788abebe2

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 08:54

Target

2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe
Size

109KB
MD5

b7846b679f666adc0f3f04f562032e07
SHA1

558af2d645c8e831701a03da38633c94bc09e956
SHA256

c1bfb2bf8a20867aca636033637eec9ff0a021037c36466c12cb40f788abebe2
SHA512

f7867e001416b6b4d0d53c50bc9583a7971f4c2ce3f24aed8aad599e839e9cfc3ac07c9fba748ac1f7e477f4f74d2b89091b46b7f17b9c6fbb37c3c97e1d21d4
SSDEEP

1536:aXNJHAELvdQJH2MeTXyXwRdhRjXcbKFWGVZ4A/SLLM/+IpghdguuPh8l/H2SOzhj:bELdQ3QsKFvIW+Ipe6m/ozZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	2328	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 860	2328	2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe	28
PID 2328 wrote to memory of 860	2328	2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe	28
PID 2328 wrote to memory of 860	2328	2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe	28
PID 2328 wrote to memory of 860	2328	2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_b7846b679f666adc0f3f04f562032e07_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 36
  2⤵
  - Program crash
  PID:860

memory/2328-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download