ea7a26a01f1b5e159c083101130a0e3f60db21dc5801e09e67801902a35ff6e1

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 16:22

Target

5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe
Size

839KB
MD5

5f395ecb6a349478270367e8d75dae1e
SHA1

125b8f28aae91df9e6fbf481fad947171b34fe72
SHA256

ea7a26a01f1b5e159c083101130a0e3f60db21dc5801e09e67801902a35ff6e1
SHA512

ddabd7815ef0311cd3414a74e0f159b3f3fb3e2570cf9e8d701113b0785ac022c0f3d31e829027d7997e50d9419215796a6c6a0c1c4750af5d6b00e9f7c897e6
SSDEEP

24576:PDnQg7YNMrSaqiS4BoW+N5RWy5Jl4dMKlWLggE9rEpMA:LnQGOc+Ww5Qybl4dCknEKA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	2468	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2556	2468	5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe	28
PID 2468 wrote to memory of 2556	2468	5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe	28
PID 2468 wrote to memory of 2556	2468	5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe	28
PID 2468 wrote to memory of 2556	2468	5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5f395ecb6a349478270367e8d75dae1e_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 44
  2⤵
  - Program crash
  PID:2556

memory/2468-56-0x0000000000B30000-0x0000000000C10060-memory.dmp

Filesize
896KB

Download
memory/2468-55-0x0000000000B30000-0x0000000000C10060-memory.dmp

Filesize
896KB

Download
memory/2468-57-0x0000000000B30000-0x0000000000C10060-memory.dmp

Filesize
896KB

Download
memory/2468-58-0x0000000000B30000-0x0000000000C10060-memory.dmp

Filesize
896KB

Download