Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 21:05
Behavioral task
behavioral1
Sample
20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe
Resource
win10v2004-20240426-en
General
-
Target
20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe
-
Size
139KB
-
MD5
030a37a4fcd7ab0589153da356debf25
-
SHA1
35f94d32cd61329996fc65f4ba3a94d86262944c
-
SHA256
cec908909002b6bc46b7d98aeb908cb5e94de9f6cd8544772a6cb860b50bafa6
-
SHA512
8d7fe7c71d4d536fbf0171ba978a4bb6c5393e5e8e3376ce00b948609d4392277f6278fe2296e0e7824537aa20a3cea99b93e4dc76fd9e49bf00d6c1461dc4c3
-
SSDEEP
3072:IRDukUiIuqQHCVT9NwoPsaMqqDL2/OgvduI:IRDfgBVwoPsJqqDL6PvduI
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2200 2184 WerFault.exe 20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exedescription pid process target process PID 2184 wrote to memory of 2200 2184 20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe WerFault.exe PID 2184 wrote to memory of 2200 2184 20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe WerFault.exe PID 2184 wrote to memory of 2200 2184 20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe WerFault.exe PID 2184 wrote to memory of 2200 2184 20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe"C:\Users\Admin\AppData\Local\Temp\20240524030a37a4fcd7ab0589153da356debf25bkransomwaregandcrabkaragany.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 362⤵
- Program crash
PID:2200