634db5fe8466359b8e61869a338d4d28734397ae5a450d3c9d4c8f0812a352b8

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 16:57

Target

fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe
Size

428KB
MD5

fa520b4274cd46d9d64ec58a3b194d05
SHA1

94d5e432e639a38d86ab99a3d67cc5817d093343
SHA256

634db5fe8466359b8e61869a338d4d28734397ae5a450d3c9d4c8f0812a352b8
SHA512

1b3f0e1bbf9d8c17d1b0a84cde0c6e89653f5e49a1f0950e9a36b44c802fd865807b36d3c8dde7c4c87435ba79be25fb614402a16fd00d2152e0b15541df7013
SSDEEP

12288:Z594+AcL4tBekiuKzErZ4YR7Cs0N/3dbDFYlHvTCMQl:BL4tBekiuVrqYIs0NPdVEvI

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3844	71A6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3844	1476	fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe	80
PID 1476 wrote to memory of 3844	1476	fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe	80
PID 1476 wrote to memory of 3844	1476	fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\71A6.tmp
  "C:\Users\Admin\AppData\Local\Temp\71A6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe 819D59B6ADA334F0B2B78FB06430AC97616CB2A8C14690BF90CD7BC068B634A5423ED9DB954C116CCF5ED1351E052A6019B143BF62CE1DA2FA7EA9CE253CE682
  2⤵
  - Executes dropped EXE
  PID:3844

C:\Users\Admin\AppData\Local\Temp\71A6.tmp

Filesize
428KB

MD5
fa0ac3fdcd8abea008fee8000b8386d8

SHA1
248b25af62d2f1c1e5b4553d0505db9b7ba4d95a

SHA256
4689b6e873fc5c11ef13c0f91c029bb38d1f3983fc550e835947d1c852ba2c56

SHA512
2a8f3324ba7a807dc8e18ed114f65b32dcd5cb53baa857a3b907c80bd7307c3d58adbfbe755711d613cf307898664e4086fe5874bcbf8dc7fb9be6a7a1634363

Download Submit
C:\Users\Admin\AppData\Local\Temp\71A6.tmp

Filesize
428KB

MD5
fa0ac3fdcd8abea008fee8000b8386d8

SHA1
248b25af62d2f1c1e5b4553d0505db9b7ba4d95a

SHA256
4689b6e873fc5c11ef13c0f91c029bb38d1f3983fc550e835947d1c852ba2c56

SHA512
2a8f3324ba7a807dc8e18ed114f65b32dcd5cb53baa857a3b907c80bd7307c3d58adbfbe755711d613cf307898664e4086fe5874bcbf8dc7fb9be6a7a1634363

Download Submit