9e3fc10cff834924295fd8f18790793a54c5b7f6ec52a114bbd4dab9c5f7f9ef

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03-08-2023 15:32

Target

49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe
Size

368KB
MD5

49d20752b0f8cd50a01a96eab16bbd1b
SHA1

2aa026869223267ec4b7b83f64cc1624ac99c3bb
SHA256

9e3fc10cff834924295fd8f18790793a54c5b7f6ec52a114bbd4dab9c5f7f9ef
SHA512

77da9ebc6c8af337fa68ccd3e81415d4ae96b87cb6eb78cc05498bb3d8fd155ed67ebae98beea5bbc98b8d85429e037e3de36d1d66dcb08dc0512a1e03db3d1f
SSDEEP

6144:qHd2snwZDkCUbuu3zt3FrNPMXDuOYijvafatfhDV9XUBiljRFC:qHd2sncDkC03JFlMXKujvafaBhDV97G

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 2564 WerFault.exe 49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe

pid	pid_target	process	target process
2300	2564	WerFault.exe	49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe

description	pid	process	target process
PID 2564 wrote to memory of 2300	2564	49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe	WerFault.exe
PID 2564 wrote to memory of 2300	2564	49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe	WerFault.exe
PID 2564 wrote to memory of 2300	2564	49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe	WerFault.exe
PID 2564 wrote to memory of 2300	2564	49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\49d20752b0f8cd50a01a96eab16bbd1b_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 120
2⤵
- Program crash
PID:2300