c941e2bc64ae0b7e42b7a0a097836de21cd44fdff257dc0693ee2432d78c0ff7

Analysis

max time kernel
128s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 17:41

Target

3cdebfcf15a54615381775d02e69672e_mafia_JC.exe
Size

414KB
MD5

3cdebfcf15a54615381775d02e69672e
SHA1

5b318dea182fbde1b6cd65b3e8571111ea07af28
SHA256

c941e2bc64ae0b7e42b7a0a097836de21cd44fdff257dc0693ee2432d78c0ff7
SHA512

c7fec9ff9a7b338ce3c51b2b82890b4fcc192caca2870e478608620aaaa2659aee38140b5a5d01035e0d3cfaeff90f636b9b79f4cd36e3e8c8d6d21995dacad3
SSDEEP

12288:Wq4w/ekieZgU648qL98gLd3PovAN0h0BuFbSMl:Wq4w/ekieH6MrLd3gvnnFd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3256	9CEC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 3256	1928	3cdebfcf15a54615381775d02e69672e_mafia_JC.exe	84
PID 1928 wrote to memory of 3256	1928	3cdebfcf15a54615381775d02e69672e_mafia_JC.exe	84
PID 1928 wrote to memory of 3256	1928	3cdebfcf15a54615381775d02e69672e_mafia_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\3cdebfcf15a54615381775d02e69672e_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3cdebfcf15a54615381775d02e69672e_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\9CEC.tmp
  "C:\Users\Admin\AppData\Local\Temp\9CEC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\3cdebfcf15a54615381775d02e69672e_mafia_JC.exe 589C6A5F0C2C2D44F941C2424897AF644B1E63A87F984FF0E6D64A05DC9312033CD8222E9361BA325617C0BF39B23A17D4EB6E60DA520703665A1E02D2AEF7CB
  2⤵
  - Executes dropped EXE
  PID:3256

C:\Users\Admin\AppData\Local\Temp\9CEC.tmp

Filesize
414KB

MD5
ab138f4ad33984be811d6b8b0e6fbff4

SHA1
9ea946f3e8d4b8589f0ce8d620cad457d1a5fb3c

SHA256
9579504bd71d6d9b798dc3094b49a438d2f353ac3b480c9b61c46fff98ab6a4c

SHA512
3f5e3e9554b305b8181236f5761fa4a7c1b99713dd5b0c5ccb7a31ef472b201ebdf887866aea5cff0acc348f3db52661fb7840330835f4edf791566d793024e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp

Filesize
414KB

MD5
ab138f4ad33984be811d6b8b0e6fbff4

SHA1
9ea946f3e8d4b8589f0ce8d620cad457d1a5fb3c

SHA256
9579504bd71d6d9b798dc3094b49a438d2f353ac3b480c9b61c46fff98ab6a4c

SHA512
3f5e3e9554b305b8181236f5761fa4a7c1b99713dd5b0c5ccb7a31ef472b201ebdf887866aea5cff0acc348f3db52661fb7840330835f4edf791566d793024e3

Download Submit