b9b0bc24957cda8c541a427e664b55f0256ea0d1e86e5c6a64fa12cfe6240f99

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 14:47

Target

457e17727310fba640c507712869aaec_mafia_JC.exe
Size

414KB
MD5

457e17727310fba640c507712869aaec
SHA1

f1955d8541b4ac615777dd7ba452b6d3154d99c6
SHA256

b9b0bc24957cda8c541a427e664b55f0256ea0d1e86e5c6a64fa12cfe6240f99
SHA512

3788f91b813f50e37bbaf5ee8cd4e2c6ced1c7e1ba447f989d2384d4bdeefd239566587832b57e725bf07ee3722d864b2620ade1e9f9a4536795bb5deeab128a
SSDEEP

12288:Wq4w/ekieZgU6bPyqsPR6OCdWPNtfJj+vrlx:Wq4w/ekieH6bgJCdAxj+vrr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
560	8359.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 560	544	457e17727310fba640c507712869aaec_mafia_JC.exe	82
PID 544 wrote to memory of 560	544	457e17727310fba640c507712869aaec_mafia_JC.exe	82
PID 544 wrote to memory of 560	544	457e17727310fba640c507712869aaec_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\457e17727310fba640c507712869aaec_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\457e17727310fba640c507712869aaec_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\8359.tmp
  "C:\Users\Admin\AppData\Local\Temp\8359.tmp" --helpC:\Users\Admin\AppData\Local\Temp\457e17727310fba640c507712869aaec_mafia_JC.exe 72820514A6B90FA437C03EEE1D35BC4D56A816E19F78C6FDB56AD7869C698AE190F2FF615D21D7D53A86CDF28164951EA893C5EDBB0239BF42F9E05F27CB219F
  2⤵
  - Executes dropped EXE
  PID:560

C:\Users\Admin\AppData\Local\Temp\8359.tmp

Filesize
414KB

MD5
2d53fc37e6b1fc94f2c4c9c78a714c43

SHA1
92d855236c30935e14db3b1e1b3ce54bb7c00dde

SHA256
4d05ec7f4e6f02309a5b91d7ba675c47135ee98b84eb332f390ae771dc5fd242

SHA512
d70fbfcfcf0470d7af3eb17a1e51fd1e4e8534fc2f134285f95e3bb6eb7bb66e4fada9e1e5218a50a10491a4053b82478c7d01cd786d42fa917cde2a31044594

Download Submit
C:\Users\Admin\AppData\Local\Temp\8359.tmp

Filesize
414KB

MD5
2d53fc37e6b1fc94f2c4c9c78a714c43

SHA1
92d855236c30935e14db3b1e1b3ce54bb7c00dde

SHA256
4d05ec7f4e6f02309a5b91d7ba675c47135ee98b84eb332f390ae771dc5fd242

SHA512
d70fbfcfcf0470d7af3eb17a1e51fd1e4e8534fc2f134285f95e3bb6eb7bb66e4fada9e1e5218a50a10491a4053b82478c7d01cd786d42fa917cde2a31044594

Download Submit