696be15e17c03d88f01baa0dde57e7da9f8970f71c237e7ddd3189805d2c274c

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 12:46

Target

2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe
Size

155KB
MD5

0cd1a3733f2dad943d49038d5253fc4d
SHA1

be3f7a2c717a7e033ad9796e4a29d88bc09b0ee0
SHA256

696be15e17c03d88f01baa0dde57e7da9f8970f71c237e7ddd3189805d2c274c
SHA512

cf3c1a0ca11a1100ffbda16c8784c37188ff9bf10a98cbe8d0a6e63c1e6fc33cca2f7a1659d6d3a2a8045fe99c9d46681fcd01f355ca8b6cbc6fb7949a3420ba
SSDEEP

3072:l5K/B0toLWeSNJylZHQsozTS+SMqqDL2/TrKSxG:lcytwqy1yTS+xqqDL6HKV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1224 WerFault.exe 2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe

pid	pid_target	process	target process
1684	1224	WerFault.exe	2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe

description	pid	process	target process
PID 1224 wrote to memory of 1684	1224	2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe	WerFault.exe
PID 1224 wrote to memory of 1684	1224	2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe	WerFault.exe
PID 1224 wrote to memory of 1684	1224	2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe	WerFault.exe
PID 1224 wrote to memory of 1684	1224	2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_0cd1a3733f2dad943d49038d5253fc4d_bkransomware_gandcrab_karagany.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 88
2⤵
- Program crash
PID:1684