f89f1164c3f1bf6e2470cb68716debdb1a65c3d79b2b408cedcb7b51c0d7d3e3

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 16:41

Target

f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe
Size

414KB
MD5

f8ef1c8d6a9ef18a80ebc3e065026624
SHA1

3f58f2727211474131c24bb760a248ddb639e6c5
SHA256

f89f1164c3f1bf6e2470cb68716debdb1a65c3d79b2b408cedcb7b51c0d7d3e3
SHA512

4064d07710b5eef6f11a54c36afe933611e09fc24ad7df56adad6e483e5906ccf1f39dbd914580adf75523dd44f4ebec18bb8db10effc29697a6cb7a26fea9fd
SSDEEP

12288:Wq4w/ekieZgU6HNnMlvMosNp6yxxgqUZxl:Wq4w/ekieH6HeBu+4+qUZx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3036	B3FE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3036	432	f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe	82
PID 432 wrote to memory of 3036	432	f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe	82
PID 432 wrote to memory of 3036	432	f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\B3FE.tmp
  "C:\Users\Admin\AppData\Local\Temp\B3FE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\f8ef1c8d6a9ef18a80ebc3e065026624_mafia_JC.exe 2BB84A3968EB8695C89D58345CBD8023D63F4AC10CAD8F607EF9AE2981CF0DB3F040F87EA12EFADB1B2A2918ED154F2F63D1F24F488C439D3C06A394A1E4191C
  2⤵
  - Executes dropped EXE
  PID:3036

C:\Users\Admin\AppData\Local\Temp\B3FE.tmp

Filesize
414KB

MD5
9f97632fbb60f6a710eb889d8c767228

SHA1
dcd2d5e1f1b503cc0f593aec55b29265caa9da01

SHA256
49729d643d70d5e3d751018957a4ba137ba7d7f37ae151d8799da1587703e9ca

SHA512
02e81f503e57d9ebc83eced47437336d942ea17f6bf9a225060d173ac83da9a1820eee6990932842e34c2ea37e8474f850de5ac35efa86d08a99a20a5c36af91

Download Submit
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp

Filesize
414KB

MD5
9f97632fbb60f6a710eb889d8c767228

SHA1
dcd2d5e1f1b503cc0f593aec55b29265caa9da01

SHA256
49729d643d70d5e3d751018957a4ba137ba7d7f37ae151d8799da1587703e9ca

SHA512
02e81f503e57d9ebc83eced47437336d942ea17f6bf9a225060d173ac83da9a1820eee6990932842e34c2ea37e8474f850de5ac35efa86d08a99a20a5c36af91

Download Submit