127449c7827bd097bfa13bc47c4bdbe6febc23898351929f0215dd0135dff41e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 02:10

Target

2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe
Size

201KB
MD5

90095c731a586d6ac1e1166722d8e85d
SHA1

8c8c84a905306af9f8f69b4fb1693b983cb7afbc
SHA256

127449c7827bd097bfa13bc47c4bdbe6febc23898351929f0215dd0135dff41e
SHA512

dfc4cced5ff005b6dc0d1489d9633580b3b9f6f5fc6799ae1ce860c71c3783c5a3a9f4fc8f265adcfe11a192ef7fb4a3863a1e85aa674390fbf3bcb975ca029f
SSDEEP

3072:HYhFPTBe7QUMGGJk0RU/CeNhqZniAHFsKO7DP90HIp2U5FMbB6GPdUdcJD:4hm7RpG2JNUZFFsKuKa5t+diMD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2104	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2160	2104	2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe	28
PID 2104 wrote to memory of 2160	2104	2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe	28
PID 2104 wrote to memory of 2160	2104	2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe	28
PID 2104 wrote to memory of 2160	2104	2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_90095c731a586d6ac1e1166722d8e85d_virlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 36
  2⤵
  - Program crash
  PID:2160

memory/2104-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download