71c448587effc005359071cf69be34bba650e7f99535930a2c55f867188ed833

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 11:39

Target

locky-31.5.exe
Size

191KB
MD5

148dc5f342462f056f214896c3ece162
SHA1

ae463dce3a66e5d668d71d5b6e68bc2c81eac623
SHA256

0c357e3d47167b7370ce5578bb25c4f1c8b1cd87dbd398ecc07bccdac5087aa1
SHA512

86bed4fd43964cdd699e9c37a3db929c3863b7e3874909708c843c0291b3358ec0ea0c0255b87ce59c9ee09031256ac4c64d6bfdcabbe242c98a811770314899
SSDEEP

3072:hRzGicKjPc1MZV+U76+QhXqD7VIADAQcFkBkHoB80xWZ7VVdcvAD/VQbwb2Y:zaicKLc4dWX+qKTcFqkHorxWZ7Ddcve/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 2904	2056	locky-31.5.exe	30

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2820	2056	locky-31.5.exe	28
PID 2056 wrote to memory of 2820	2056	locky-31.5.exe	28
PID 2056 wrote to memory of 2820	2056	locky-31.5.exe	28
PID 2056 wrote to memory of 2820	2056	locky-31.5.exe	28
PID 2056 wrote to memory of 1356	2056	locky-31.5.exe	29
PID 2056 wrote to memory of 1356	2056	locky-31.5.exe	29
PID 2056 wrote to memory of 1356	2056	locky-31.5.exe	29
PID 2056 wrote to memory of 1356	2056	locky-31.5.exe	29
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30
PID 2056 wrote to memory of 2904	2056	locky-31.5.exe	30

C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe
"C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe
  "C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe"
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe
  "C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe"
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe
  "C:\Users\Admin\AppData\Local\Temp\locky-31.5.exe"
  2⤵
  PID:2904

memory/2904-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2904-19-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2904-18-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download