Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 03:37
Behavioral task
behavioral1
Sample
2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe
Resource
win10v2004-20230915-en
1 signatures
150 seconds
General
-
Target
2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe
-
Size
141KB
-
MD5
3b105b795c2796841f1a9a56acc130ee
-
SHA1
3ceb671b82d2380ed8617302624cee19d59f7d4e
-
SHA256
f305260fbdd6bde46470e5139de8f8c585d5cc4cd9d07bf83796ff393e001bf7
-
SHA512
3b4591e003f4a54c34070b5e2a67ae124163fbcab9c25d69ef8c80c5a1b5ed2d5454984acab30dbc774098d3c5cdf89a1b580c53cddcf25f1deec15ebd4b68d2
-
SSDEEP
3072:m5tmM+m8qQH5Us4QL1nMqqDL2/OPvdlR:m5t3uj4QL1MqqDL6svdlR
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1712 1672 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1712 1672 2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe 28 PID 1672 wrote to memory of 1712 1672 2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe 28 PID 1672 wrote to memory of 1712 1672 2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe 28 PID 1672 wrote to memory of 1712 1672 2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 362⤵
- Program crash
PID:1712
-