18eff8f401fa41e801e53fb92021c2749e182d92e53047f90a65bbd7d2e769ed

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 01:20

Target

2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe
Size

2.8MB
MD5

ee310f937349fde9340aa60a13f09dbe
SHA1

8d423758e4c9ea44f2d60d6be6cd5820228e220f
SHA256

18eff8f401fa41e801e53fb92021c2749e182d92e53047f90a65bbd7d2e769ed
SHA512

6dff8101a999d071d74649725efd661868444b5061a655ab816bb64d962965e9aff1e082b1ca48341c09041f0c82bb988ed356675ad2aad36d602c5296556b71
SSDEEP

49152:KYzV9colMmavuainElgx9VJzxY/ufB48duiXdqDS20gv/6x7Phn6XLBnw1AJyMpm:f9cUMmavuaiyu9VJ2/ufB1uiXIDS20gq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2420	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2144	2420	2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe	28
PID 2420 wrote to memory of 2144	2420	2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe	28
PID 2420 wrote to memory of 2144	2420	2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe	28
PID 2420 wrote to memory of 2144	2420	2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_ee310f937349fde9340aa60a13f09dbe_mafia.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 240
  2⤵
  - Program crash
  PID:2144