01229cb7aa62051c2e9d3de0e96416ec5690350f4d51fdd4663881ab8a90be99

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 22:22

Target

2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe
Size

50KB
MD5

28b48284d8f66a85972a4f48eef0f29f
SHA1

31f443806e390cf2f20453f530f89820fddb19a6
SHA256

01229cb7aa62051c2e9d3de0e96416ec5690350f4d51fdd4663881ab8a90be99
SHA512

89852e22a67094c82de1bf9589807b1bd22b61f9d0c0a25300f77bf4e8d59e6541ee69a4fb993390b509a7e0ff04063844eb1d658c4cc4c299b162dd9e5aaafc
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZYn:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLin

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001269e-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001269e-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2688	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2688	2868	2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe	28
PID 2868 wrote to memory of 2688	2868	2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe	28
PID 2868 wrote to memory of 2688	2868	2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe	28
PID 2868 wrote to memory of 2688	2868	2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_28b48284d8f66a85972a4f48eef0f29f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2688

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
f875ba25bfe92d5f3818f74a5148a982

SHA1
102aab9c34900f3b5a67f603ee8ac4473145f2bd

SHA256
6726032c9481745f339181d9dfa3943bd0ffe34ac22339496b03f0fd0bb7a4c9

SHA512
4d5871862f692184d8ab54e191e3f1489e379b07915d399a262ad1e2ca1b99ff169d9ad18e961a4cdc3abcfc450949ef2aec2fa8ea7b9a53449cb19aae8c77f0

Download Submit
memory/2688-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2688-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2868-7-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2868-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2868-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download