fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 19:13

Target

2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe
Size

349KB
MD5

b3de9ac3741d8503b9886d7f6c9ee12e
SHA1

950b740f736291fb013c4f7efcd2618cde0cb348
SHA256

fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30
SHA512

0a59657f2d6860927a26ef882f9a3182320c8b863b65d5bd4582fec3607b14ed2ad2cfd9d856e97eb2ae05ce4ca01cbe8e5f4cc0eb568d127d1411ed74c86c57
SSDEEP

6144:q+jfY43T97LdTJQnzkr5meQzK0uY5C0kfHaYyJv5xma2L6yYUPyBt0T9az:q+jffT97L9JQnzkr5meQzK0uuC0kSnLJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 2944 WerFault.exe 2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe

pid	pid_target	process	target process
1652	2944	WerFault.exe	2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe

description	pid	process	target process
PID 2944 wrote to memory of 1652	2944	2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_b3de9ac3741d8503b9886d7f6c9ee12e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 48
2⤵
- Program crash
PID:1652