4f3dad7c354eb0349b0ba8dd48b19b5c153c802116ed93b667a1fc60f42f85b8

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 14:30

Target

4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe
Size

978KB
MD5

4499b12ccd52d9141310cdeafef4984b
SHA1

78011fdafb54bef0e4969c98b04eace2cba6c323
SHA256

4f3dad7c354eb0349b0ba8dd48b19b5c153c802116ed93b667a1fc60f42f85b8
SHA512

4ac09114ac9f49c8f315fe1aa7f631da9c2e82940e35aa68057e23c6f576fdbf99d9e37b7cb657ea50a97257bc9122e13408191c11fe2d7cbfedd13d81eeb5af
SSDEEP

24576:+K4cXgGT+sNh/HGAeHkdbQ2I4yl1oRKOS2Tn3p/QrB:X4cHyAeE5A4y35UpIrB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2232	2896	4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe	28
PID 2896 wrote to memory of 2232	2896	4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe	28
PID 2896 wrote to memory of 2232	2896	4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe	28
PID 2896 wrote to memory of 2232	2896	4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4499b12ccd52d9141310cdeafef4984b_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 36
  2⤵
  - Program crash
  PID:2232

memory/2896-56-0x0000000000B70000-0x0000000000C73000-memory.dmp

Filesize
1.0MB

Download
memory/2896-55-0x0000000000B70000-0x0000000000C73000-memory.dmp

Filesize
1.0MB

Download
memory/2896-57-0x0000000000B70000-0x0000000000C73000-memory.dmp

Filesize
1.0MB

Download
memory/2896-58-0x0000000000B70000-0x0000000000C73000-memory.dmp

Filesize
1.0MB

Download