0ddb03eacea4765c154830c691064091be7876d8e83d0a9368cf5e4fcd431b5f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 00:51

Target

2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe
Size

227KB
MD5

b2da9cdeede8c737f86c8fe2e9dbd745
SHA1

5ca13925d79176fae2a850a2abcf025da12f915d
SHA256

0ddb03eacea4765c154830c691064091be7876d8e83d0a9368cf5e4fcd431b5f
SHA512

0428cef1a2ace57f57a786ce1d7e0489581ea424424d822bc5fd41c9d62577d9fe083f47b93e854738b4cd3d8ebdbcb6e3b0a4118dee9ce204ba5724326ac6ba
SSDEEP

6144:ndY5o00kd0lvhEFKhJ0LvPtE6Byq4qpnzY:nde0kd07CKhqvPtE6D4GzY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	1736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2680	1736	2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe	28
PID 1736 wrote to memory of 2680	1736	2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe	28
PID 1736 wrote to memory of 2680	1736	2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe	28
PID 1736 wrote to memory of 2680	1736	2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_b2da9cdeede8c737f86c8fe2e9dbd745_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 120
  2⤵
  - Program crash
  PID:2680