7a20cfabcbd9837bf4d4cb75532c359f4f0b24eb41cf600d9d7c6366036379b1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:43

Target

2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe
Size

339KB
MD5

ba43cc9e2091a8add937a648f25a0e7d
SHA1

e7afd97850dc401e51f0e406ffcaf1cfef987d78
SHA256

7a20cfabcbd9837bf4d4cb75532c359f4f0b24eb41cf600d9d7c6366036379b1
SHA512

77b8fdb45d79c0beb2ae65979b0bccdba4fef613e65a71c69e0c204f1512ff6d5504908a54ab423433ca302da36247bb3c10a6e17f9b1f9b5f301b6742847bf1
SSDEEP

6144:ELBuyhqGYtATZ7aYN2IxhzsgWQx77HitfKW35t9iARoULv:Edu+qGYONaUN/sjADitfKWJjdRT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 1632 WerFault.exe 2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe

pid	pid_target	process	target process
2192	1632	WerFault.exe	2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe

description	pid	process	target process
PID 1632 wrote to memory of 2192	1632	2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe	WerFault.exe
PID 1632 wrote to memory of 2192	1632	2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe	WerFault.exe
PID 1632 wrote to memory of 2192	1632	2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe	WerFault.exe
PID 1632 wrote to memory of 2192	1632	2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba43cc9e2091a8add937a648f25a0e7d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 120
2⤵
- Program crash
PID:2192