b8e9837c3e19630ec4633ea25968fc2f5ad9c726288b923e2fd29d210835c635

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 18:06

Target

36969711cf59ee41a17166051fef8202_mafia_JC.exe
Size

1.7MB
MD5

36969711cf59ee41a17166051fef8202
SHA1

c85a59aacfe650dc3af85dd4a5aec5edf8608762
SHA256

b8e9837c3e19630ec4633ea25968fc2f5ad9c726288b923e2fd29d210835c635
SHA512

cba512bc5f98a4ea2ffc93a52f02dda8cba21de05844bcd5a2fa69e1d6316926588e3b384d524dde5b8de5efb620209fa18a33f566d876616022116e4fa231cc
SSDEEP

24576:5flzKNK6PJpOB5Ix/v5J4UKJxv1/R0zPGv1/R0zPfqlfi+pO:rzK/AIJvX4UKJxvFR06vFR00f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	2440	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1380	2440	36969711cf59ee41a17166051fef8202_mafia_JC.exe	28
PID 2440 wrote to memory of 1380	2440	36969711cf59ee41a17166051fef8202_mafia_JC.exe	28
PID 2440 wrote to memory of 1380	2440	36969711cf59ee41a17166051fef8202_mafia_JC.exe	28
PID 2440 wrote to memory of 1380	2440	36969711cf59ee41a17166051fef8202_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\36969711cf59ee41a17166051fef8202_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\36969711cf59ee41a17166051fef8202_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 36
  2⤵
  - Program crash
  PID:1380

memory/2440-53-0x0000000000670000-0x0000000000826000-memory.dmp

Filesize
1.7MB

Download
memory/2440-54-0x0000000000670000-0x0000000000826000-memory.dmp

Filesize
1.7MB

Download
memory/2440-55-0x0000000000670000-0x0000000000826000-memory.dmp

Filesize
1.7MB

Download
memory/2440-56-0x0000000000670000-0x0000000000826000-memory.dmp

Filesize
1.7MB

Download