213d190907cce9fb2a2cceb05c3fdefc6814ec4e752a20c89beb59d1b93fac2a

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 00:24

Target

2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe
Size

53KB
MD5

20796e9be6bd218543b627306983f12e
SHA1

b1aa48abe997fd3f5fc64fc4e198591a1759b1d3
SHA256

213d190907cce9fb2a2cceb05c3fdefc6814ec4e752a20c89beb59d1b93fac2a
SHA512

887e0402e9840418af3eed32cc854650f5b67106357cec9e29edd4a04864347e34d2dcbc78640b1cc5d0be18db5fac449e546b82ba128ddde7824c8f2ab89738
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTCFWpzgVor:X6QFElP6n+gJBMOtEvwDpjBtELVC

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015d79-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015d79-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2476	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2476	1972	2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe	28
PID 1972 wrote to memory of 2476	1972	2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe	28
PID 1972 wrote to memory of 2476	1972	2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe	28
PID 1972 wrote to memory of 2476	1972	2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-12_20796e9be6bd218543b627306983f12e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
7d9ccb1051e7f13b5692adeca7e41bd4

SHA1
49330502fc1b743b348f1a1bbd7f97dbfb0957c2

SHA256
37f50c07a01703ddcccbd7687a446739ae5dc5a74ef7470d4d6a0052c0b99ff4

SHA512
e75544b52d43e80f445cbb8605c288d0708375aeee534dfc2c055b149d28821764c51bacfe3b1a0fb29fca5d1e2c508b53763bd8eea3e256a74b3a00c51412ad

Download Submit
memory/1972-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/1972-1-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/1972-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2476-15-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2476-22-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download