Analysis

  • max time kernel
    120s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 03:37

General

  • Target

    2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe

  • Size

    141KB

  • MD5

    3b105b795c2796841f1a9a56acc130ee

  • SHA1

    3ceb671b82d2380ed8617302624cee19d59f7d4e

  • SHA256

    f305260fbdd6bde46470e5139de8f8c585d5cc4cd9d07bf83796ff393e001bf7

  • SHA512

    3b4591e003f4a54c34070b5e2a67ae124163fbcab9c25d69ef8c80c5a1b5ed2d5454984acab30dbc774098d3c5cdf89a1b580c53cddcf25f1deec15ebd4b68d2

  • SSDEEP

    3072:m5tmM+m8qQH5Us4QL1nMqqDL2/OPvdlR:m5t3uj4QL1MqqDL6svdlR

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-25_3b105b795c2796841f1a9a56acc130ee_gandcrab_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 36
      2⤵
      • Program crash
      PID:1712

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads