784358512ca2bc828e531b0eef7078f23c0c4343a4b0132c7c45bb8e9ff04e3a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:59

Target

2024-06-15_3f578601bf69dcef3ada278473dd875b_mafia.exe
Size

1003KB
MD5

3f578601bf69dcef3ada278473dd875b
SHA1

459046e601e6fdd6fe663440c51f0eda6318377a
SHA256

784358512ca2bc828e531b0eef7078f23c0c4343a4b0132c7c45bb8e9ff04e3a
SHA512

4d98ca110b1bcd368e6927d27fff5f456e1bddc0fd6f05a110f5d01d749a98a1d5a43cb4c49df84fe775c4201f4fd5baaf6126e8b8bf5c2d600c018b7ca45477
SSDEEP

24576:qCF3zBpmk05EUvYzr/AqR9b+R2gLUddfss1QaH1bIe3K07oJ4cTz+kQeS/:lhzBpmkIEIqRhd0aVbIev7oJ4cTCkQee

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3032	2100	WerFault.exe	83
1688	2100	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	2024-06-15_3f578601bf69dcef3ada278473dd875b_mafia.exe
2100	2024-06-15_3f578601bf69dcef3ada278473dd875b_mafia.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

C:\Users\Admin\AppData\Local\Temp\2024-06-15_3f578601bf69dcef3ada278473dd875b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_3f578601bf69dcef3ada278473dd875b_mafia.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 780
  2⤵
  - Program crash
  PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 800
  2⤵
  - Program crash
  PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 2100
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2100 -ip 2100
1⤵
PID:2732