ab61601093b2b590d8c17d3f5ff82df563729a16c32e429b23359abc7c94dff5

Analysis

max time kernel
91s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 13:41

Target

2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe
Size

29.3MB
MD5

e48136def86336e3c10b5feb1bf9c9d2
SHA1

097b2f45cbfdb719e400bc3eeea1243b05fcda51
SHA256

ab61601093b2b590d8c17d3f5ff82df563729a16c32e429b23359abc7c94dff5
SHA512

88c1a93fd71bf425d0944cc3fdaf6b79bd6c52211d94c16b78478c0c3efb04c4b5378fab9558caa01eaaa8b09b25fc21644dd5bc9665524de01b930f41ef5d49
SSDEEP

786432:lbhHEC6spTNQI9TJZ8vwd+17PjTOJf6YC:dZEXETNQcj4wdu7ryhy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	4024	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4024	2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_e48136def86336e3c10b5feb1bf9c9d2_mafia.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1080
  2⤵
  - Program crash
  PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 212 -p 4024 -ip 4024
1⤵
PID:1000

memory/4024-0-0x0000000010000000-0x0000000010B93000-memory.dmp

Filesize
11.6MB

Download
memory/4024-8-0x0000000006740000-0x0000000006744000-memory.dmp

Filesize
16KB

Download
memory/4024-9-0x00000000066C0000-0x00000000066C4000-memory.dmp

Filesize
16KB

Download
memory/4024-10-0x0000000008420000-0x0000000008448000-memory.dmp

Filesize
160KB

Download