0aaa55c40b6c87ea528cc38083c619455e6b8e7e01d6e1d313da8cefcadb3cea

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 18:31

Target

2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe
Size

432KB
MD5

76ef4f5728861281ae77fb8ef7cf780f
SHA1

bad5ef1bcd1c3c85ed2d5d77a01c76f2ee98a3a6
SHA256

0aaa55c40b6c87ea528cc38083c619455e6b8e7e01d6e1d313da8cefcadb3cea
SHA512

8e03675165692e8d1ef7cc4b4dfdad163fd3cd23159050c25c29fe485182a04d18ffbd49eaf3983afd1b783d3b14a56e6199b0ad4a6b739d74b75e1590781a7c
SSDEEP

6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4aJSqdBFJVkShVU:z6HX5aG782ook65G/id5CV5JvZVk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	1460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2144	1460	2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe	28
PID 1460 wrote to memory of 2144	1460	2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe	28
PID 1460 wrote to memory of 2144	1460	2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe	28
PID 1460 wrote to memory of 2144	1460	2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_76ef4f5728861281ae77fb8ef7cf780f_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 36
  2⤵
  - Program crash
  PID:2144