6c0cf193fe5dffe409ca56fc1f12edfcd21c42fcf202a43b706f16f44dab934f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:01

Target

2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe
Size

964KB
MD5

86f8a2415a4c7ce7a96467662396b9ac
SHA1

ab1f26ce71709b5065b1162cd862fedb256f7309
SHA256

6c0cf193fe5dffe409ca56fc1f12edfcd21c42fcf202a43b706f16f44dab934f
SHA512

4841a09456ba0cd1a51fca1a054ff2d3d3dac9fe029c4dcf5c7258a487191ff1245e18df9a4cea4326221040fe608da7947c234c4ce79db7b0f5f50745a698f1
SSDEEP

12288:QQRaGD3E8zntitkBC7JDydU0uff9TDGUAREFZQV1LJZ9AV3fF7V/2:Tbr5ZC7Qe5laUQEFZQ39A99J/2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2188	2416	2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe	28
PID 2416 wrote to memory of 2188	2416	2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe	28
PID 2416 wrote to memory of 2188	2416	2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe	28
PID 2416 wrote to memory of 2188	2416	2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_86f8a2415a4c7ce7a96467662396b9ac_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 176
  2⤵
  - Program crash
  PID:2188