ed0ea0eb79a93951e03fe07fef76c51fab21e6c0d79df3867d8d60f88437d928

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 10:51

Target

2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe
Size

341KB
MD5

e677092a00b6bbb0c541a8af62b3384e
SHA1

eb0ed0893e9a7f160e9f3e5275645931d4d26bd7
SHA256

ed0ea0eb79a93951e03fe07fef76c51fab21e6c0d79df3867d8d60f88437d928
SHA512

9fb1f987da9b02a4b806ec2cb435b46cb798ca5150d6981f39e1dce9734f591e74a0349ea6a7115a253f69e66bfd0f8b19d4434cb54bdc615e538353ef117c82
SSDEEP

6144:CDZmBlZ87p0vRhZ/u8AfjVO0M9qm9YlTjOYRLXhMNm9M:CDZmBi0BA7g0Wqm9mjOYRLaUM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	2068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1600	2068	2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe	28
PID 2068 wrote to memory of 1600	2068	2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe	28
PID 2068 wrote to memory of 1600	2068	2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe	28
PID 2068 wrote to memory of 1600	2068	2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_e677092a00b6bbb0c541a8af62b3384e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 120
  2⤵
  - Program crash
  PID:1600