bb495b6769de2686f3bf8c0ff14dd238b84b4f23bad0bf8a05d32a6ac27c5423

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 12:37

Target

2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe
Size

2.3MB
MD5

7e91b817b10f3e4d504af0b5f6aceee0
SHA1

e7d94a84fe3f4129744f70dddd08281fe2f7c363
SHA256

bb495b6769de2686f3bf8c0ff14dd238b84b4f23bad0bf8a05d32a6ac27c5423
SHA512

9b9fbca01857241d1c5e970bd19ca1af5af6589a803819f6e44ecdc7dfb6759295480859ce75e6658c8275e498fc0287a81a20fade1853724f960fc69ba3fa87
SSDEEP

49152:/Omma84EjDMG4uJ6cVGUNE0aRXFrt8lukoVXKs1H5tOXF2QUTU4STzFYY0Oews1o:/Ona846DMsM0G/0aRXFR1VXKOvUcQUTp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2200	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2188	2200	2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe	28
PID 2200 wrote to memory of 2188	2200	2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe	28
PID 2200 wrote to memory of 2188	2200	2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe	28
PID 2200 wrote to memory of 2188	2200	2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_7e91b817b10f3e4d504af0b5f6aceee0_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 176
  2⤵
  - Program crash
  PID:2188