60a2b9b905c74f4b4a128758ebf1ce5321f70f972a7f877f35da0c2d52c6ac52

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 06:30

Target

2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe
Size

143KB
MD5

605d7e3e4a7be56c8c56be744579b7eb
SHA1

3f762e6d2e89388babbb1ce705610dc9ab2230b3
SHA256

60a2b9b905c74f4b4a128758ebf1ce5321f70f972a7f877f35da0c2d52c6ac52
SHA512

13b0cde9b9c713fd1382376ebc64c8f1547232a5191e7c0782558607d9b38573eac6a6ed0b1ed41944b6840ec72f51f32ef98a2d92269a36661552c1cfcde162
SSDEEP

3072:o+HcL2ICfoTntqSQRruiMZMqqDL2/Awvdi7Vjp9:hwDtORruiMyqqDL6tvdop9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2352	2368	2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe	28
PID 2368 wrote to memory of 2352	2368	2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe	28
PID 2368 wrote to memory of 2352	2368	2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe	28
PID 2368 wrote to memory of 2352	2368	2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_605d7e3e4a7be56c8c56be744579b7eb_bkransomware_gandcrab_karagany.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 88
  2⤵
  - Program crash
  PID:2352