2368a67968cb7cb4e8acc4f7330e4203bcd5fa3dfac123ef8f325686ed1e0ee6

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 14:16

Target

948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe
Size

141KB
MD5

948e1145e3a01f8beb9692bab430741d
SHA1

386020de7d243873b8b0eff0bbc1203268346e97
SHA256

2368a67968cb7cb4e8acc4f7330e4203bcd5fa3dfac123ef8f325686ed1e0ee6
SHA512

e2f25e373f3b0f8c5f700d046fe645f0cc0bb2c7f87c25b8627a3b805933b373067bfb194b32d9af394b6336814ccf01b415501aed9922238602cc8fd99adcf0
SSDEEP

3072:m5tmM+mjqQHPUs4QL1nMqqDL2/OPvdlX:m5t3bj4QL1MqqDL6svdlX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2580	2132	948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe	28
PID 2132 wrote to memory of 2580	2132	948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe	28
PID 2132 wrote to memory of 2580	2132	948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe	28
PID 2132 wrote to memory of 2580	2132	948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\948e1145e3a01f8beb9692bab430741d_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 36
  2⤵
  - Program crash
  PID:2580