971bb374f3f4c1d179697b3a0f387eb3360ee3ddb888eb2335d480efc2443f7a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:22

Target

2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe
Size

2.1MB
MD5

e7d2b8f60ad367cf1b20c1664dfabcc7
SHA1

a95b78692ddc9b950a44689971e339e4f3102211
SHA256

971bb374f3f4c1d179697b3a0f387eb3360ee3ddb888eb2335d480efc2443f7a
SHA512

ac45381965d8f8967d490ce7597d96b6241efc3e33152bcbdf3c70f8f655d8af12b3d0dd2abe796c507ba142e6f0906b638b28f41db2028f24339c57336a27ff
SSDEEP

49152:e9yiCJ5rFwnANZGEXeZ+9ex8egOSDAmosh3ANkTTl:dJ5rFwnApeJgOS9V3AM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

784 2208 WerFault.exe 2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe

pid	pid_target	process	target process
784	2208	WerFault.exe	2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe

description	pid	process	target process
PID 2208 wrote to memory of 784	2208	2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe	WerFault.exe
PID 2208 wrote to memory of 784	2208	2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe	WerFault.exe
PID 2208 wrote to memory of 784	2208	2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe	WerFault.exe
PID 2208 wrote to memory of 784	2208	2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_e7d2b8f60ad367cf1b20c1664dfabcc7_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 116
2⤵
- Program crash
PID:784