locky | 2c379a21876e829c1eeed773990eabe617d8a605b67a03b953e87dfd2c116852

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 18:18

Target

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
Size

233KB
MD5

13f1cf097fc8c3a883bd1af16be4afad
SHA1

080261b84d573ab3757497c94ae70cbb9e014d20
SHA256

2c379a21876e829c1eeed773990eabe617d8a605b67a03b953e87dfd2c116852
SHA512

c94c5db0547949933fe86e6ee8ab9ff007d8df5155fb9eb28dea66e80e43e7babfbada288d9a542db0522fdaafc0ff2ffb17b7af3aee5e03c769d7866defb022
SSDEEP

6144:+8ImR5cnj/QdAWSTtTWylI2+Tvloy5NESJCDZ1pv2/PsD:+MR5cnj/GACfvKpOCDHC6

Score

10^/10

locky ransomware

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Suspicious use of SetThreadContext 1 IoCs

Processes:

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

description	pid	process	target process
PID 2580 set thread context of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2800	4996	WerFault.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
1516	4996	WerFault.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

description	pid	process	target process
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2580 wrote to memory of 4996	2580	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4996 -ip 4996
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4996 -ip 4996
1⤵
PID:4912

memory/2580-0-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/2580-1-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/2580-3-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/4996-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4996-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4996-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download