5c588b196d72676fc0935349178a809defe740bcbce759ab579f69505a435e6d

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 16:59

Target

2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe
Size

971KB
MD5

87d20d9a9353e97697cac4af11d62b2a
SHA1

6da7fdb27ebe7b2a182ca09a7edfad2ead574205
SHA256

5c588b196d72676fc0935349178a809defe740bcbce759ab579f69505a435e6d
SHA512

35a4b352269d2b8d7f30e7ada75e2199e713aa3a8296f4b95487b3262143f52323829713430e377180eb35b8c98fe58f1f8be031791b22a7d2ba19a6854e207f
SSDEEP

24576:OGmj8GFiYBcNDDot26QkBqbVJSj4Soy8xnHbev+:OGmg/lDtx/04SR+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2916	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2992	2916	2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe	28
PID 2916 wrote to memory of 2992	2916	2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe	28
PID 2916 wrote to memory of 2992	2916	2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe	28
PID 2916 wrote to memory of 2992	2916	2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_87d20d9a9353e97697cac4af11d62b2a_mafia_qakbot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 36
  2⤵
  - Program crash
  PID:2992

memory/2916-2-0x0000000001221000-0x00000000012B2000-memory.dmp

Filesize
580KB

Download
memory/2916-0-0x0000000001220000-0x0000000001321000-memory.dmp

Filesize
1.0MB

Download
memory/2916-1-0x0000000001220000-0x0000000001321000-memory.dmp

Filesize
1.0MB

Download
memory/2916-3-0x0000000001220000-0x0000000001321000-memory.dmp

Filesize
1.0MB

Download
memory/2916-4-0x0000000001221000-0x00000000012B2000-memory.dmp

Filesize
580KB

Download