6977f33cc1068f167fb01fee259701c03ab4e1eece1c39448968036c170a3c20

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 12:50

Target

2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe
Size

155KB
MD5

c95cef43ead105b35a32fa665027480c
SHA1

c191895f1464d1c61831b51e62a52a11decd6354
SHA256

6977f33cc1068f167fb01fee259701c03ab4e1eece1c39448968036c170a3c20
SHA512

9db78668924757c29c606fb0b7c6117c57a5fc31b26822e87c5647ae84314dec3bde97d5dc318c308b49f318a939b07492d218cfc8e2d16fef0addb08c1426a3
SSDEEP

3072:l5K/B0toLQSNJblZHQsozTS+SMqqDL2/TrKXlG:lcytwtB1yTS+xqqDL6HK4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2568	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2972	2568	2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe	28
PID 2568 wrote to memory of 2972	2568	2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe	28
PID 2568 wrote to memory of 2972	2568	2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe	28
PID 2568 wrote to memory of 2972	2568	2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_c95cef43ead105b35a32fa665027480c_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 88
  2⤵
  - Program crash
  PID:2972