b66c6b1ab475062791c434300734c09f7c349a2b5e52327848b18ed1c1441b38

Analysis

max time kernel
118s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2023, 16:00

Target

4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe
Size

412KB
MD5

4aa17d8e50641aa9e194618063ec65ae
SHA1

93816cb53c251e28d940faea7aeca4af3621548f
SHA256

b66c6b1ab475062791c434300734c09f7c349a2b5e52327848b18ed1c1441b38
SHA512

c78a98916f4289b87706dc401493d036888da0ef8a9c94aef6b2512bbafd09e339b7a0e43431ca740a6b628a2ae2d2c69107cd54dec115aadcac35348df65f44
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFjzCDoZ0B76SBYw+fPl2dIdDs9GqH:gZLolhNVyEKCDoZ0B76S5I2idDQGqH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2608	DED7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2608	3240	4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe	80
PID 3240 wrote to memory of 2608	3240	4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe	80
PID 3240 wrote to memory of 2608	3240	4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\DED7.tmp
  "C:\Users\Admin\AppData\Local\Temp\DED7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\4aa17d8e50641aa9e194618063ec65ae_mafia_JC.exe 833C9BF2E9532CBB5E2C4829796F01C00A223B5DF90CB1A14EA2B2018FD702C23CF0ADE1975796F8D8A569ACF3AAFE1CA208AD511DAB51B5DB2777DD968A3218
  2⤵
  - Executes dropped EXE
  PID:2608

C:\Users\Admin\AppData\Local\Temp\DED7.tmp

Filesize
412KB

MD5
9d12634404925a5cf21fba4f033db9ba

SHA1
31caca8cc676b3e787933bca155905d9f90fa2fa

SHA256
65e4dd581acfe60baf09abcddd66ef88955d98e5e8991e2f299de9621ecbde1e

SHA512
ec50ea94f8cf9246b5c17e15b1ae42c1845548fb33e338217791313f8121f7c06400640b5910438d2209813c28de1c56ac91983c52875ded169b465b92ca0838

Download Submit
C:\Users\Admin\AppData\Local\Temp\DED7.tmp

Filesize
412KB

MD5
9d12634404925a5cf21fba4f033db9ba

SHA1
31caca8cc676b3e787933bca155905d9f90fa2fa

SHA256
65e4dd581acfe60baf09abcddd66ef88955d98e5e8991e2f299de9621ecbde1e

SHA512
ec50ea94f8cf9246b5c17e15b1ae42c1845548fb33e338217791313f8121f7c06400640b5910438d2209813c28de1c56ac91983c52875ded169b465b92ca0838

Download Submit