d855dcd157b0d7405847aee77b789287e935d70385fee679494a2510d4f3b5ae

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 15:09

Target

2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe
Size

155KB
MD5

078c1e4cc011559b12bb7c040ea14d91
SHA1

fdd109637e152fd436cfcc071ed29895ae50bdb3
SHA256

d855dcd157b0d7405847aee77b789287e935d70385fee679494a2510d4f3b5ae
SHA512

67c5f5993d1bf371b54a3082fb6d11796cff90cb559391316576962c6ce8bde79ca8dc24d9816df8bb55ab6ef323934b2dbc54361eeabf7c1e46af9f89b9c61a
SSDEEP

3072:l5K/B0toL4SNJXlZHQsozTS+SMqqDL2/TrKPnG:lcytwVV1yTS+xqqDL6HKe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2880	3040	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2880	3040	2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe	1
PID 3040 wrote to memory of 2880	3040	2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe	1
PID 3040 wrote to memory of 2880	3040	2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe	1
PID 3040 wrote to memory of 2880	3040	2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 88
1⤵
- Program crash
PID:2880

C:\Users\Admin\AppData\Local\Temp\2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-23_078c1e4cc011559b12bb7c040ea14d91_gandcrab_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040