97f292eee4c61c97f90c1847ae3702ad7e16a94f0edfd74837d36bb3240d3a4e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/08/2023, 15:53

Target

823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe
Size

141KB
MD5

823de8d0f4bd99678dadc82654b251a6
SHA1

66202d1ecc77e4a46982173b0e0c0779c2ab640d
SHA256

97f292eee4c61c97f90c1847ae3702ad7e16a94f0edfd74837d36bb3240d3a4e
SHA512

9393dd7b5d00ab78fff556a5f54c3b26f64921e19df42b7d1014b4c1d20dcfe239561d112b1d11ff86e30cbcd5d2eeab1859f34f8de96ee6618f690491d514d9
SSDEEP

3072:m5tmM+mvqQHZUs4QL1nMqqDL2/OPvdlK:m5t35j4QL1MqqDL6svdlK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	2364	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2396	2364	823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe	28
PID 2364 wrote to memory of 2396	2364	823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe	28
PID 2364 wrote to memory of 2396	2364	823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe	28
PID 2364 wrote to memory of 2396	2364	823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\823de8d0f4bd99678dadc82654b251a6_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 36
  2⤵
  - Program crash
  PID:2396