14c6f8520edee094586244f530782ca92c4a568fa61c4604ba5b1632da77455e

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 00:35

Target

2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe
Size

84KB
MD5

447ca6806ef2db20485c607d17db63d7
SHA1

d2a7ccdef2fa28860ebe133f8e294cfd14d8b6c7
SHA256

14c6f8520edee094586244f530782ca92c4a568fa61c4604ba5b1632da77455e
SHA512

06b82df2185779825e95361b339319c76f97b78077acf14dc7996c935e9c8f317ffc18f6fe658c98ed705f7acffacf0d9e2cea8ba39a5eb04a36412cf1162e6b
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yFPnjh:V6QFElP6n+gMQMOtEvwDpjyaLccVNlL

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000143fb-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000143fb-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2904	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3036	2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2904	3036	2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe	28
PID 3036 wrote to memory of 2904	3036	2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe	28
PID 3036 wrote to memory of 2904	3036	2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe	28
PID 3036 wrote to memory of 2904	3036	2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_447ca6806ef2db20485c607d17db63d7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2904

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
84KB

MD5
8c378fd248a2494a8ee5b526d1027123

SHA1
b22c8d160ee25c440b577cfe1573316a2b04f83e

SHA256
b540c218b27def1544ad86f72b6ab7479e3f3a8dc49875b56336bcfb138d1bfa

SHA512
928df25e5edd3f2c178482d8cf3f757d30cbc248ad890c25a17dcef6e67933d06f23dd73251b4d0649a706de0a55e9c2dcb469748a57739534bd0b1ac5e04730

Download Submit
memory/2904-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2904-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3036-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3036-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3036-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download