7d8963694fb83c6104dc4534ed963501b035cf0924334705c8918625ee16f80a

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 18:19

Target

7005f722191899c29ec187ca3156a028_mafia_JC.exe
Size

412KB
MD5

7005f722191899c29ec187ca3156a028
SHA1

b52730cb7b5b0c0bf5a894136813cbee6b2e963a
SHA256

7d8963694fb83c6104dc4534ed963501b035cf0924334705c8918625ee16f80a
SHA512

12418643cc6d88939dd1a899aca308ee777bb342b2b60bea34e2a6e6159f63ca5be0d6295e759d216ce52cf9b7648448c544b798341977b3c4ada70293736f7b
SSDEEP

12288:U6PCrIc9kph5RVmXYGNDj6Fmd9BjbLVUi:U6QIcOh5OZNH4mdXd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1276	B805.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1276	1412	7005f722191899c29ec187ca3156a028_mafia_JC.exe	80
PID 1412 wrote to memory of 1276	1412	7005f722191899c29ec187ca3156a028_mafia_JC.exe	80
PID 1412 wrote to memory of 1276	1412	7005f722191899c29ec187ca3156a028_mafia_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\7005f722191899c29ec187ca3156a028_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7005f722191899c29ec187ca3156a028_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\B805.tmp
  "C:\Users\Admin\AppData\Local\Temp\B805.tmp" --pingC:\Users\Admin\AppData\Local\Temp\7005f722191899c29ec187ca3156a028_mafia_JC.exe DF3F6FCBC343B599962C1430449C77BBCFA5A2874612B5D65A467727024522E46BD855BDC3FE7106BC9B5DE99806FEBD9BAB5EEA8BBC1CDBCEBFF841DEF6E5D3
  2⤵
  - Executes dropped EXE
  PID:1276

C:\Users\Admin\AppData\Local\Temp\B805.tmp

Filesize
412KB

MD5
bd75d23fde6f1b6c4f2e22e30679a8d2

SHA1
dd4511285a2dc644f35f7d1d289c07c256029a7d

SHA256
a98f9fda421b1b188fd023686348311c139f5efbb7da0270afbc7bf6e92febc7

SHA512
4358781f477caa5df6b9c79656977514cdf59ecd3efa1495be71b270605ee06f6ec3917f090ad857eaafb2fd8efdab1fdf0ad8cd92a4c61b6f1ba180e9b3c37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B805.tmp

Filesize
412KB

MD5
bd75d23fde6f1b6c4f2e22e30679a8d2

SHA1
dd4511285a2dc644f35f7d1d289c07c256029a7d

SHA256
a98f9fda421b1b188fd023686348311c139f5efbb7da0270afbc7bf6e92febc7

SHA512
4358781f477caa5df6b9c79656977514cdf59ecd3efa1495be71b270605ee06f6ec3917f090ad857eaafb2fd8efdab1fdf0ad8cd92a4c61b6f1ba180e9b3c37a

Download Submit