Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2024, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9746c942c665567a9285df17f325506.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9746c942c665567a9285df17f325506.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
a9746c942c665567a9285df17f325506.exe
-
Size
250KB
-
MD5
a9746c942c665567a9285df17f325506
-
SHA1
6f0cfd31f2ec39051f7ccb3d9f5590e0d4a83bcb
-
SHA256
f4bc6c510f2c555db083fa55b6c941c62e7e5e476dd020fe2ebd615d61bbdf1f
-
SHA512
29b9f2bc73459d0cce9262a4e4bd72b3a5082cd8f7062687be757cffab6a42d4156d01b0707d61d97cf7ae4633fa86c03cd20dcb9e34b9d5ccc3d9b76a5e1143
-
SSDEEP
6144:z+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:HOCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/3212-3-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral2/memory/3212-4-0x00000000021D0000-0x00000000021E7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4820 3212 WerFault.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9746c942c665567a9285df17f325506.exe"C:\Users\Admin\AppData\Local\Temp\a9746c942c665567a9285df17f325506.exe"1⤵PID:3212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 4722⤵
- Program crash
PID:4820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3212 -ip 32121⤵PID:2400