ee46f6f8e7e49ebcf58e4ad0d86b205bf0e47d53506369216f75ee7af8a5f17a

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 17:46 UTC

Target

2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe
Size

2.1MB
MD5

346127de65d2e29686e3f8e424c19375
SHA1

bda386164bac3c3eb3842ec7e1853ffa00103f15
SHA256

ee46f6f8e7e49ebcf58e4ad0d86b205bf0e47d53506369216f75ee7af8a5f17a
SHA512

d894c17e4d82dc634dcc106605dd33e08b76153d105eaf78f843ea7b0dfe27126d20b2b7fe1dfa94eb3450d165707d6e2cf8b12c9aede4b3f80f928afdf244d2
SSDEEP

49152:q9yiCJ5rFwnANZGEXeZ+9Gx8egOSDAmosh3ANkTTl:BJ5rFwnApe5gOS9V3AM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	808	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2108	808	2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe	28
PID 808 wrote to memory of 2108	808	2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe	28
PID 808 wrote to memory of 2108	808	2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe	28
PID 808 wrote to memory of 2108	808	2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_346127de65d2e29686e3f8e424c19375_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 116
  2⤵
  - Program crash
  PID:2108