552674d9c0e34fef69ab0e24cdb3a0021c5037ccf27a14c19c1bc2cd53fa838d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02-08-2023 17:36

Target

3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe
Size

955KB
MD5

3c9bf5c9e8981d986713a94fd240aad0
SHA1

2c9243a84cd1326b07cdf5e44bcd3bc191d10c48
SHA256

552674d9c0e34fef69ab0e24cdb3a0021c5037ccf27a14c19c1bc2cd53fa838d
SHA512

cdc5e924d7cbdd8fd8bf1374c4240c3e3cfd5b6cb01168ef6835a74a296a0da29bac9ccbbe1743e71957f5cb767a5d64dc2b0b8e27c7a7c0b754de3b16490433
SSDEEP

24576:MnC4DKWSMViXQZ3LmJuvLfUFENz4ygDTosJY/Tqa:14szJ4fMEJ4yKRJY3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	748	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1776	748	3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe	28
PID 748 wrote to memory of 1776	748	3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe	28
PID 748 wrote to memory of 1776	748	3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe	28
PID 748 wrote to memory of 1776	748	3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3c9bf5c9e8981d986713a94fd240aad0_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 36
  2⤵
  - Program crash
  PID:1776

memory/748-55-0x0000000000250000-0x000000000034C660-memory.dmp

Filesize
1009KB

Download
memory/748-54-0x0000000000250000-0x000000000034C660-memory.dmp

Filesize
1009KB

Download
memory/748-56-0x0000000000250000-0x000000000034C660-memory.dmp

Filesize
1009KB

Download
memory/748-57-0x0000000000250000-0x000000000034C660-memory.dmp

Filesize
1009KB

Download
memory/748-58-0x0000000000250000-0x000000000034C660-memory.dmp

Filesize
1009KB

Download