82cd4a0964c8d06e93647cc09e79b6af04365bd028a55e9324c1993a686d05b4

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/05/2023, 02:46

Target

2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe
Size

155KB
MD5

f3cf738a1f02ede9f3540ddfb6bf1f04
SHA1

7596ff22a91203a970c4e7c99b693d703f225c8c
SHA256

82cd4a0964c8d06e93647cc09e79b6af04365bd028a55e9324c1993a686d05b4
SHA512

fde0ba3b1baa19ae8a0397e8085fa6bcbb8ce96de6af8a121fc9f1b99096a183f1c0754fecd00e75bb44f6d578cf85a01d23a29ef25ff2f6c0458e091976ba7c
SSDEEP

3072:l5K/B0toLJSNJ0lZHQsozTS+SMqqDL2/TrKszGw:lcytwk81yTS+xqqDL6HKxw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1776	2036	2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe	28
PID 2036 wrote to memory of 1776	2036	2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe	28
PID 2036 wrote to memory of 1776	2036	2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe	28
PID 2036 wrote to memory of 1776	2036	2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-16_f3cf738a1f02ede9f3540ddfb6bf1f04_gandcrab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 88
  2⤵
  - Program crash
  PID:1776