cadd86a67a7d967de341e84c903277c5af99ee9662657518c26799a26fb811cb

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 12:42

Target

2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe
Size

155KB
MD5

03b10e65640b70e403f4eb0990e8e307
SHA1

1727a3c23c73e6635b204160ce49123700533806
SHA256

cadd86a67a7d967de341e84c903277c5af99ee9662657518c26799a26fb811cb
SHA512

e04c578bb4a13d1ff7e5f90587af82de136ebe6312bfc2b4ccd7ce901e9c1c3c5164a5db82623e48e4d9e9b046a508acca24f39098b0c22d5d88d8b998aff5e9
SSDEEP

3072:S5K/B0toLLSNJRlxwsx89TSdBgjMqqDL2/TOKCeG:ScytwWcTTSdBgQqqDL6SKO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1700	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2180	1700	2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe	28
PID 1700 wrote to memory of 2180	1700	2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe	28
PID 1700 wrote to memory of 2180	1700	2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe	28
PID 1700 wrote to memory of 2180	1700	2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-16_03b10e65640b70e403f4eb0990e8e307_bkransomware_gandcrab_karagany.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 88
  2⤵
  - Program crash
  PID:2180