gandcrab | 952-56-0x0000000000400000-0x000000000045A000-memory[.]dmp | Triage

Sharing

General

Target

952-56-0x0000000000400000-0x000000000045A000-memory.dmp
Size

360KB
MD5

37f33f955f1c43c02b43421349692206
SHA1

2c9fff590b0b97387b5e805b7511179b3fadb533
SHA256

67951cc750ee363dcf6c1691826519c8c4b4be21df32a65140095d321d25481d
SHA512

aa2b906a700b4b97e88f396d4a1edcc5aec80c888ac255db15eeb61c4827572ff95bf8099931204967d5cadfd1a91ec84447881381a311d255bfd3489dcccd6d
SSDEEP

6144:lcytwkW1yTS+xqqDL6HKRgfYJ9JohMYRbkslNtEGpTS:CyhW1Rqn6qRgf48WYRbXlNtEGTS

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Files

952-56-0x0000000000400000-0x000000000045A000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ