42fd8731fa09e3b6cb100bd5d72f28a82f76a4e452035999649bfe9d9d476e3e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 17:01

Target

19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe
Size

143KB
MD5

19853035c86da08ff5a2e8a39e01b59f
SHA1

84fd3082cafd44d1558c9706eadbc81eb4e123c3
SHA256

42fd8731fa09e3b6cb100bd5d72f28a82f76a4e452035999649bfe9d9d476e3e
SHA512

e1c4f1868c62dfb8c1847a576b2402140bb4b48cd924cc6bf48f8c2232a9296899b2e040a0065dad831c835e46b1ded2e0ae42edf903fed58ec565d93960f772
SSDEEP

3072:o+HcL2dCfGTntqSQRruiMZMqqDL2/AwvdA7Vjp9:hXDtORruiMyqqDL6tvdSp9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	1136	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2560	1136	19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe	28
PID 1136 wrote to memory of 2560	1136	19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe	28
PID 1136 wrote to memory of 2560	1136	19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe	28
PID 1136 wrote to memory of 2560	1136	19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\19853035c86da08ff5a2e8a39e01b59f_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 88
  2⤵
  - Program crash
  PID:2560