Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
09-08-2023 15:55
Behavioral task
behavioral1
Sample
a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe
-
Size
368KB
-
MD5
a3f32ae6acdf14b5d05664daf70541c6
-
SHA1
f546f74e02e6a0ef726a42a8fbec3c0098b08b84
-
SHA256
35bf676f97e2f6ffb96006c99d2f27cd175436e291a7f5b5e6f7d67f5b1326f3
-
SHA512
c52398e64714acf3ea6d03cc62eb0e1b94cb3cab0796ce287ef3dfe47cacbc6d90ae63e775b1ebd441a8492410b68e5215aa20299dbfaef493cc5df5710a5472
-
SSDEEP
6144:qHd2snwZDkCUbuu3zt3FrNPMXDuOYijvafGtfhDV9XUBiljAvC:qHd2sncDkC03JFlMXKujvafGBhDV97z
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1636 2572 WerFault.exe a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exedescription pid process target process PID 2572 wrote to memory of 1636 2572 a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe WerFault.exe PID 2572 wrote to memory of 1636 2572 a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe WerFault.exe PID 2572 wrote to memory of 1636 2572 a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe WerFault.exe PID 2572 wrote to memory of 1636 2572 a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a3f32ae6acdf14b5d05664daf70541c6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 1202⤵
- Program crash