fcdeab3eec049b3c0da9793377b25f48f3ff7cf17db67d2df4858eccd0d3495c

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 12:06

Target

8719c071e7b48608fa04305b13ea160b_mafia_JC.exe
Size

412KB
MD5

8719c071e7b48608fa04305b13ea160b
SHA1

7b6323eb60e0d7d814c706680225ef6b60a2413a
SHA256

fcdeab3eec049b3c0da9793377b25f48f3ff7cf17db67d2df4858eccd0d3495c
SHA512

d5b47e2b7f218ae13f68cb05d7fc7d702004608b11e9a2b2576394ec9d141e0ef7e60a0fda6660c76ae3ed246fe2c9b2c76f07be18626f10d5c8a3aeef966db6
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnaoX5HZDAZrSGqqTc9Ir2v2jTcbwfXGmMLVP:U6PCrIc9kph5x55k8GVc6Kv2fcsXGmk

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3688	6C66.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 3688	932	8719c071e7b48608fa04305b13ea160b_mafia_JC.exe	81
PID 932 wrote to memory of 3688	932	8719c071e7b48608fa04305b13ea160b_mafia_JC.exe	81
PID 932 wrote to memory of 3688	932	8719c071e7b48608fa04305b13ea160b_mafia_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\8719c071e7b48608fa04305b13ea160b_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8719c071e7b48608fa04305b13ea160b_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\6C66.tmp
  "C:\Users\Admin\AppData\Local\Temp\6C66.tmp" --pingC:\Users\Admin\AppData\Local\Temp\8719c071e7b48608fa04305b13ea160b_mafia_JC.exe E74E6C33088B87C8B950B4E2147450FB850D9EED85F088007CCCF5A880A9CF94421B93BE4206492EBFF293ACD3DD2AA15351EE0B517FAE482D5DE1555A252796
  2⤵
  - Executes dropped EXE
  PID:3688

C:\Users\Admin\AppData\Local\Temp\6C66.tmp

Filesize
412KB

MD5
36383bf98f7ebd3feef2be89ae9e5fab

SHA1
d2c579e794b0ce2dcc0c5759d3c9df59692b519f

SHA256
d132dda078afa95f79633de41275b5523ef67616ad28b819c4879c57247b85c9

SHA512
b0beabd471ae39ad729fae7c2328c16cfd3e89e9fced0f8361ba7f558e5b56843917da2c2de0f93179bfc3b759df3dca8765fadc41419129928695cd5db45f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\6C66.tmp

Filesize
412KB

MD5
36383bf98f7ebd3feef2be89ae9e5fab

SHA1
d2c579e794b0ce2dcc0c5759d3c9df59692b519f

SHA256
d132dda078afa95f79633de41275b5523ef67616ad28b819c4879c57247b85c9

SHA512
b0beabd471ae39ad729fae7c2328c16cfd3e89e9fced0f8361ba7f558e5b56843917da2c2de0f93179bfc3b759df3dca8765fadc41419129928695cd5db45f00

Download Submit