gandcrab | 1452-54-0x0000000000400000-0x000000000059A000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1452-54-0x0000000000400000-0x000000000059A000-memory.dmp
Size

1.6MB
MD5

0c15277333ddc9264ce3865b46013aff
SHA1

a3cdac1308d96d46f19b0a98df46bce104767007
SHA256

7ef086aef9120bfcf1ec8cf4ca035e65656ea5f469d76ad2d3a25bb84715c502
SHA512

bdefccbb9ddba01a9183214cbf8eb1b3b8a334b4b6e7d7f90d7a11864860fa3ca2d0f35dfd0270eb70e4b6a01578cfeeabe5ab01711ce99b4fbf416164433b2f
SSDEEP

6144:O9iQiA0C9WruiM7qqDL6avdjGd1my6xEzNTFI82bKsyAj9kEFiANvtK:O9iQi6Iqn6mjGd1rzNpIppD9kEfv

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Files

1452-54-0x0000000000400000-0x000000000059A000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ