5f9cdd807e1d43d76831f167ef1ef9c940443c251ed8599c973f38dbd0dca4ab

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 14:11

Target

2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe
Size

2.1MB
MD5

f55be30bbe3f60edcacc497c6f8ac06a
SHA1

642ff762bee7f1d314508eb818d1ebebfdd13281
SHA256

5f9cdd807e1d43d76831f167ef1ef9c940443c251ed8599c973f38dbd0dca4ab
SHA512

21533ab844ad7929669b9f64dc8106340180b37f00ee996d7152542791cca79ec4d9bb362dc9cfce2e7a26c91179fda2d9194f6398b93d0cd8b34b3ccc9cfa8d
SSDEEP

49152:c9yiCJ5rFwnANZGEXeZ+9+x8egOSDAmosh3ANkTTl:TJ5rFwnApexgOS9V3AM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1632	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2192	1632	2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe	28
PID 1632 wrote to memory of 2192	1632	2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe	28
PID 1632 wrote to memory of 2192	1632	2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe	28
PID 1632 wrote to memory of 2192	1632	2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_f55be30bbe3f60edcacc497c6f8ac06a_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 116
  2⤵
  - Program crash
  PID:2192