7725e04ae2183ae8537207b7cabb1df8b34aa103b66a8651a729de7701e650cf

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 15:07

Target

f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe
Size

831KB
MD5

f03a14f649ab6f5497f99889566b4cad
SHA1

cf24a8767441334d26a0f2127caa6c4e4105f2d9
SHA256

7725e04ae2183ae8537207b7cabb1df8b34aa103b66a8651a729de7701e650cf
SHA512

6ba5a68fdd4deb2b316b26611144670e76f12b64660862143936065766d22244578e6fdd4df6efd4d8655a5750417c59a4b82800eabe33366699ba5ad1c5742c
SSDEEP

24576:bmCn29eft8KG3McfxnCGYCsQCuiUvlk45E7Qcn21hWDhK:X2kfCvUGY1Q7iyW45Kn21hWU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	532	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1488	532	f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe	28
PID 532 wrote to memory of 1488	532	f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe	28
PID 532 wrote to memory of 1488	532	f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe	28
PID 532 wrote to memory of 1488	532	f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f03a14f649ab6f5497f99889566b4cad_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 44
  2⤵
  - Program crash
  PID:1488

memory/532-0-0x0000000000A90000-0x0000000000B6CC60-memory.dmp

Filesize
883KB

Download
memory/532-3-0x0000000000A90000-0x0000000000B6CC60-memory.dmp

Filesize
883KB

Download
memory/532-2-0x0000000000A90000-0x0000000000B6CC60-memory.dmp

Filesize
883KB

Download
memory/532-4-0x0000000000A90000-0x0000000000B6CC60-memory.dmp

Filesize
883KB

Download