2aa963c59529309864c0539e2e35b03ef8b7144e1c0d41df7899af0dcbe4f938

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 02:50

Target
2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe
Size 155KB
Sample240526-dblaqada49
SHA256 2aa963c59529309864c0539e2e35b03ef8b7144e1c0d41df7899af0dcbe4f938
MD5 9544f0b22ac3b9bbc2bd2ed8795df6ad
SHA1 8a170988a6f4508208e26fa17e8b787a22b09cf3
SHA512 927482a8855ee60f3164626a737d9fad4a812e32b437bbf6bc93a0d6c7d9e0f18cadce26324f31d772c316b6c1311775c25556a27216702d38fe9d0f88c719a5
SSDEEP 3072:S5K/B0toLQSNJMlxwsx89TSdBgjMqqDL2/TOKyLG:ScytwtPTTSdBgQqqDL6SKn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2140	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2912	2140	2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe	28
PID 2140 wrote to memory of 2912	2140	2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe	28
PID 2140 wrote to memory of 2912	2140	2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe	28
PID 2140 wrote to memory of 2912	2140	2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-26_9544f0b22ac3b9bbc2bd2ed8795df6ad_bkransomware_gandcrab_karagany.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 88
  2⤵
  - Program crash
  PID:2912