c71f71ac9d244c45e8d16cbc272a854e16d8922f0b60db54fe110475fcc5b305

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 02:43

Target

2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe
Size

155KB
MD5

f19bb748148ddfb60adde61e333a9397
SHA1

2da7d40d18068234e9267b85410d6cd12afb40e2
SHA256

c71f71ac9d244c45e8d16cbc272a854e16d8922f0b60db54fe110475fcc5b305
SHA512

2aaf00c146b884ee62a72e8cbebd712c46bda0b37b81068be74d2e6844c4957f9b66c57d575a13e29db8e4310db56f2ed7ef05ac04341706f24aa22b98e3659c
SSDEEP

3072:S5K/B0toL9SNJglxwsx89TSdBgjMqqDL2/TOKyoG:ScytwwTTTSdBgQqqDL6SKc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1136	1200	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1136	1200	2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe	28
PID 1200 wrote to memory of 1136	1200	2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe	28
PID 1200 wrote to memory of 1136	1200	2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe	28
PID 1200 wrote to memory of 1136	1200	2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-31_f19bb748148ddfb60adde61e333a9397_gandcrab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 88
  2⤵
  - Program crash
  PID:1136