4345944180159b278dea20decc63a9e2e7303ffc71b327a508fe0eae54b4d155

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 18:08

Target

9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe
Size

155KB
MD5

9000718ee532bc15c3aea111a58fcc67
SHA1

0832a465d2ca1d727d90bf6b836bbde6805636c8
SHA256

4345944180159b278dea20decc63a9e2e7303ffc71b327a508fe0eae54b4d155
SHA512

a447d50179775492b32bf4b602b2af24e88d1f809d12fbfb9a8b08b062a7214476a87ac6ad3673ca196a6a101e881b7df2c10cc53ec5a27be7b4712125625c7e
SSDEEP

3072:S5K/B0toLASNJLlxwsx89TSdBgjMqqDL2/TOKi7G:Scytw92TTSdBgQqqDL6SKL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1320	2644	9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe	28
PID 2644 wrote to memory of 1320	2644	9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe	28
PID 2644 wrote to memory of 1320	2644	9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe	28
PID 2644 wrote to memory of 1320	2644	9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9000718ee532bc15c3aea111a58fcc67_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 88
  2⤵
  - Program crash
  PID:1320