9f1a74148fc1ba64da2ef6961221a8dac5ab083769bf78a219e3bfb72d0a0195

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 14:42

Target

96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe
Size

155KB
MD5

96c1b61f6f21ddf77e3b08dc0ca9b87b
SHA1

0115273083f1b2581cdf7a7a15af66a00c6638bc
SHA256

9f1a74148fc1ba64da2ef6961221a8dac5ab083769bf78a219e3bfb72d0a0195
SHA512

6a11914cdecefef038a339828488e4faa225188746815133b2c405db1e568690efa9dcb8dc96530665dded772f4f7a673b838ee64735d83e5b5523254ab4fecb
SSDEEP

3072:S5K/B0toLQSNJ4lxwsx89TSdBgjMqqDL2/TOKyjG:ScytwtjTTSdBgQqqDL6SKn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	2252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1616	2252	96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe	28
PID 2252 wrote to memory of 1616	2252	96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe	28
PID 2252 wrote to memory of 1616	2252	96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe	28
PID 2252 wrote to memory of 1616	2252	96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\96c1b61f6f21ddf77e3b08dc0ca9b87b_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 88
  2⤵
  - Program crash
  PID:1616