b4eeae4178b46a796a824a579f2b812e8b970a8c5027b7affa6bfdc37a4e85d9

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 18:48

Target

2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe
Size

433KB
MD5

2167fb7f0ea899dd4e7498878f24d634
SHA1

c11c18fb53c67debd435cf5c15756fd8e080e8f3
SHA256

b4eeae4178b46a796a824a579f2b812e8b970a8c5027b7affa6bfdc37a4e85d9
SHA512

d6f1bd1b1a245a1edfc51d836084e00d91e32c03540762cdb628fb3098f2dca8f5c05cad1ef632084924a52a34641593261952d9c54e507c915a229effb72ddf
SSDEEP

12288:Ci4g+yU+0pAiv+H1tjkFpnXVih9PAAB0AK80NdZn:Ci4gXn0pD+VtgF9XVih9PRDN0zB

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4156	9385.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4156	3820	2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe	81
PID 3820 wrote to memory of 4156	3820	2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe	81
PID 3820 wrote to memory of 4156	3820	2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\9385.tmp
  "C:\Users\Admin\AppData\Local\Temp\9385.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2167fb7f0ea899dd4e7498878f24d634_mafia_JC.exe 5F92D29FB3CACD6243458DB51B4F2629BF6079BFA25525DA8FBF221005C93B982914CF2797F37ED4D35BBF578DD1A70BBFFAA72F46555119232B154A14BB4ACE
  2⤵
  - Executes dropped EXE
  PID:4156

C:\Users\Admin\AppData\Local\Temp\9385.tmp

Filesize
433KB

MD5
71995b1057d61471da4cda8685cfc255

SHA1
e1cfd8739fdf6f3df7c98c4c6a9b4d9ddf5c7b44

SHA256
b39604cad19055ab3a5b463e92f26d90aa7b85a30130c614e69c4fcfcc5a25ce

SHA512
b4218d53c8634245ed471a90ebdd969755fb63f7a0a015f75589314c94f22324263ab9ac7d537f49e1f6d953e6290ba2a944673512b7afef2539692c087e6149

Download Submit
C:\Users\Admin\AppData\Local\Temp\9385.tmp

Filesize
433KB

MD5
71995b1057d61471da4cda8685cfc255

SHA1
e1cfd8739fdf6f3df7c98c4c6a9b4d9ddf5c7b44

SHA256
b39604cad19055ab3a5b463e92f26d90aa7b85a30130c614e69c4fcfcc5a25ce

SHA512
b4218d53c8634245ed471a90ebdd969755fb63f7a0a015f75589314c94f22324263ab9ac7d537f49e1f6d953e6290ba2a944673512b7afef2539692c087e6149

Download Submit