911d0e99951bdb05964724082b170a03f260519a8219395beef3e4d8c56f7d5a

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 19:02

Target

02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe
Size

414KB
MD5

02ecd5c35b087779a92f0ea0a6cb0107
SHA1

76b04cb89e3f88f15f40a030505f1d6950fb4bd7
SHA256

911d0e99951bdb05964724082b170a03f260519a8219395beef3e4d8c56f7d5a
SHA512

43411b3da860125785330338196c727614e15ac9ca236978cfbf55a7ffe669f8ee63a865a833ad9f4646930c76f9a477efbfff00d73799050fba933ab574fb3e
SSDEEP

12288:Wq4w/ekieZgU6vjw8Lb9gkcGlCnjuuVvgHl:Wq4w/ekieH6v08NgRwCjLY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3744	DC46.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3744	1536	02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe	82
PID 1536 wrote to memory of 3744	1536	02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe	82
PID 1536 wrote to memory of 3744	1536	02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\DC46.tmp
  "C:\Users\Admin\AppData\Local\Temp\DC46.tmp" --helpC:\Users\Admin\AppData\Local\Temp\02ecd5c35b087779a92f0ea0a6cb0107_mafia_JC.exe 02A7FF3C7E3C8D74098CFE2987D5CED6464B31BAD745D95E36FD05AF5E54A2C2E60DE8672823330F0E47790F4366FA7DC63A6DAC9002509B6E23800B7C514041
  2⤵
  - Executes dropped EXE
  PID:3744

C:\Users\Admin\AppData\Local\Temp\DC46.tmp

Filesize
414KB

MD5
8b7cf8850dc998039f14e9e02595886f

SHA1
0c3fe67c5bf18e15575890214bf824899cfb205a

SHA256
ef520ac0ee1f3ac49ef579b8751e47fbb5c297fa5dca02b268bb054cbffaf6a6

SHA512
4dfd4a89a30844f112b1fbf63103a2765d21d65f57d05a469d0bb188557365bc5c43e0a3ae8b78a358506b6b92ed54bd4c291858099afecca32618e373bbd7f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DC46.tmp

Filesize
414KB

MD5
8b7cf8850dc998039f14e9e02595886f

SHA1
0c3fe67c5bf18e15575890214bf824899cfb205a

SHA256
ef520ac0ee1f3ac49ef579b8751e47fbb5c297fa5dca02b268bb054cbffaf6a6

SHA512
4dfd4a89a30844f112b1fbf63103a2765d21d65f57d05a469d0bb188557365bc5c43e0a3ae8b78a358506b6b92ed54bd4c291858099afecca32618e373bbd7f9

Download Submit