122e671fe838234199a58757de27c04164cc1e325ffcbcd0b9aa7b0ac2923e74

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:03

Target

2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe
Size

337KB
MD5

ae3ddcded12a93302c74abf5e21f66d1
SHA1

fef0c5b3c688f239ead6512ad898d56b9c883845
SHA256

122e671fe838234199a58757de27c04164cc1e325ffcbcd0b9aa7b0ac2923e74
SHA512

04c2aa8c5e2e7e8b3fc06ebc7dcc971b460265418272e28cde58e6492716a9b9bc6ba0e04c47ab21dc9b6ab7a3163096cf8cb0a2a77bd5ba0642b762db07f178
SSDEEP

6144:/3Tda56pLHgYRKuzSXhUMZg8qy6ImWfB+35vGoGU/Yr:/3To56pHgDugaMq3ofB+3VXKr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 1888 WerFault.exe 2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe

pid	pid_target	process	target process
2960	1888	WerFault.exe	2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe

description	pid	process	target process
PID 1888 wrote to memory of 2960	1888	2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe	WerFault.exe
PID 1888 wrote to memory of 2960	1888	2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe	WerFault.exe
PID 1888 wrote to memory of 2960	1888	2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe	WerFault.exe
PID 1888 wrote to memory of 2960	1888	2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_ae3ddcded12a93302c74abf5e21f66d1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 120
2⤵
- Program crash
PID:2960