8d342c6461f5854f55165e4838da5e7d962af2afc90e89fad53af1fee99d6c0d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 16:55

Target

2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe
Size

194KB
MD5

451ec148709ea06b5ee3b4822093878e
SHA1

bc1045825b0c7ec6c61cbcb8a224515ff31d6623
SHA256

8d342c6461f5854f55165e4838da5e7d962af2afc90e89fad53af1fee99d6c0d
SHA512

a72a8f72c724e91efe81209a0aee1ac5ed02cf6bf61de109e5c808cd495b78ac6752f962a0e6d7551f31d42afc7ba8d553a352b7914b484a22f20389c640f292
SSDEEP

3072:5fxX5CdxfT+cKUbtaYrWjyuJf4J71TPMwQaQxLjLc/oLKfEpr3jJfk:9lUbdrWmu1V1lZc1El3pk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2328	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2356	2328	2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe	28
PID 2328 wrote to memory of 2356	2328	2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe	28
PID 2328 wrote to memory of 2356	2328	2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe	28
PID 2328 wrote to memory of 2356	2328	2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_451ec148709ea06b5ee3b4822093878e_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 36
  2⤵
  - Program crash
  PID:2356

memory/2328-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download