d53e44faf2d2a081f4a2aa650219c196633edd513dcffcca93c9007ce10c2118

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:28

Target

2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe
Size

61KB
MD5

225e92f5020c90213c84a2cdcbc4886a
SHA1

17c5a862de5910727c1583189f6db62c06c10896
SHA256

d53e44faf2d2a081f4a2aa650219c196633edd513dcffcca93c9007ce10c2118
SHA512

d3c4354d0d7d84206c4a7adcac0442c4f609d2a699e9ee41ede3093f3bc462792f5ddf4b1e310f2cd7a51bfd2431cbf9f42c58f5f691e8ade740d69323e653f9
SSDEEP

1536:/zFbxmLPZQMOtEvwDpjS86Sj/WprgJN6tZdOyJ36uZ:/VxkzOtEvwDpjnaL

Score

9^/10

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral1/memory/1428-0-0x0000000000500000-0x000000000050C000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1428-2-0x0000000000500000-0x000000000050C000-memory.dmp	CryptoLocker_rule2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1428	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2192	1428	2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe	28
PID 1428 wrote to memory of 2192	1428	2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe	28
PID 1428 wrote to memory of 2192	1428	2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe	28
PID 1428 wrote to memory of 2192	1428	2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_225e92f5020c90213c84a2cdcbc4886a_cryptolocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 88
  2⤵
  - Program crash
  PID:2192

memory/1428-0-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/1428-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1428-2-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download