a6bdab84cbd13fa8eddfe0df2d070a4fc8ccba9d47e9b0b337467bbe74946d1a

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 20:33

Target

7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe
Size

414KB
MD5

7a98617f30e957d5aeace5af51393ae5
SHA1

99f7696dc731aaae5447d63411645c77713414a3
SHA256

a6bdab84cbd13fa8eddfe0df2d070a4fc8ccba9d47e9b0b337467bbe74946d1a
SHA512

d7a67c94a4f0ea1b67277d09ebc59be55e046b13da8edd9cdc1177d85d2819ca41d56b0ea9181b36706227928ba5de31ad4c077e65635fe13ff0b032232e375a
SSDEEP

12288:Wq4w/ekieZgU6KZl+IaGEsgx1Bvs3YQxxD9fDlx:Wq4w/ekieH62l5ELxLs35xxDhDr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4200	69D6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4200	5100	7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe	81
PID 5100 wrote to memory of 4200	5100	7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe	81
PID 5100 wrote to memory of 4200	5100	7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\69D6.tmp
  "C:\Users\Admin\AppData\Local\Temp\69D6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\7a98617f30e957d5aeace5af51393ae5_mafia_JC.exe 930FA862BAD2124D79B5A04D608CF384DBD3020A17B023AAEDD5845A451D27BCDFD443EF7373D79C1BDF6ADE503FC4EDFCB7C5E347E8DAA1330CD948E8F8538C
  2⤵
  - Executes dropped EXE
  PID:4200

C:\Users\Admin\AppData\Local\Temp\69D6.tmp

Filesize
414KB

MD5
fbad554682dea03476774df322fd83ec

SHA1
663615bdb1f93e7845e89f0e4b491757d88d4a30

SHA256
b94ecaf852ead2f915c97b954fa9add0467e0cf70487eca6ce0d6886da754737

SHA512
4b49c58fb426b8cbda4d3d926b88173080216e4d4ff12d9cae3fdcda65b92e9ad9326d125dd4245b42980a6f3f890dfb9e94cf80b0790f360809e1c7caf07fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\69D6.tmp

Filesize
414KB

MD5
fbad554682dea03476774df322fd83ec

SHA1
663615bdb1f93e7845e89f0e4b491757d88d4a30

SHA256
b94ecaf852ead2f915c97b954fa9add0467e0cf70487eca6ce0d6886da754737

SHA512
4b49c58fb426b8cbda4d3d926b88173080216e4d4ff12d9cae3fdcda65b92e9ad9326d125dd4245b42980a6f3f890dfb9e94cf80b0790f360809e1c7caf07fa5

Download Submit