762c56bc925a0b5fb3e9cb75eb2edab5a79ae3688d7aefc4ab48e0c95fab5019

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 11:16

Target

8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe
Size

143KB
MD5

8e1af375bf394ff7c9bc2d1999e2e95a
SHA1

46ccd9f09911ef7b78e98689201602aa85cd8d9a
SHA256

762c56bc925a0b5fb3e9cb75eb2edab5a79ae3688d7aefc4ab48e0c95fab5019
SHA512

613b484cf9523a45b44e864edd5011518e83c63c0ad3a95f7fea793f99e4fbce142432c2075db53d5fa418f25cd0a2b00a86470d5ecf627d5b5b632981a6ba1c
SSDEEP

3072:o+HcL2pCfmTntqSQRruiMZMqqDL2/Awvdf7Vjp9:hvDtORruiMyqqDL6tvd1p9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2080	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2260	2080	8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe	28
PID 2080 wrote to memory of 2260	2080	8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe	28
PID 2080 wrote to memory of 2260	2080	8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe	28
PID 2080 wrote to memory of 2260	2080	8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e1af375bf394ff7c9bc2d1999e2e95a_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 88
  2⤵
  - Program crash
  PID:2260