ab61601093b2b590d8c17d3f5ff82df563729a16c32e429b23359abc7c94dff5

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:41

Target

2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe
Size

29.3MB
MD5

e48136def86336e3c10b5feb1bf9c9d2
SHA1

097b2f45cbfdb719e400bc3eeea1243b05fcda51
SHA256

ab61601093b2b590d8c17d3f5ff82df563729a16c32e429b23359abc7c94dff5
SHA512

88c1a93fd71bf425d0944cc3fdaf6b79bd6c52211d94c16b78478c0c3efb04c4b5378fab9558caa01eaaa8b09b25fc21644dd5bc9665524de01b930f41ef5d49
SSDEEP

786432:lbhHEC6spTNQI9TJZ8vwd+17PjTOJf6YC:dZEXETNQcj4wdu7ryhy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	1720	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2692	1720	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe	28
PID 1720 wrote to memory of 2692	1720	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe	28
PID 1720 wrote to memory of 2692	1720	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe	28
PID 1720 wrote to memory of 2692	1720	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 456
  2⤵
  - Program crash
  PID:2692

memory/1720-0-0x0000000010000000-0x0000000010B93000-memory.dmp

Filesize
11.6MB

Download
memory/1720-8-0x0000000000310000-0x0000000000314000-memory.dmp

Filesize
16KB

Download
memory/1720-9-0x00000000002A0000-0x00000000002A4000-memory.dmp

Filesize
16KB

Download
memory/1720-10-0x0000000002180000-0x00000000021A8000-memory.dmp

Filesize
160KB

Download
memory/1720-11-0x0000000002180000-0x00000000021A8000-memory.dmp

Filesize
160KB

Download