eb058ccbf8483ea665254c66d7990e651aa315eaeec303e34a7d4ba657deafaa

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2023 20:21

Target

a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe
Size

414KB
MD5

a78283f33c326f2ea3ffd727d0e4bd84
SHA1

05aa067b9e2d5e5f635a36270e9f12cae1cc7800
SHA256

eb058ccbf8483ea665254c66d7990e651aa315eaeec303e34a7d4ba657deafaa
SHA512

97caf4af4bddfc82aebe5dd2c906c8af67fa3b251290a3aecfbf38e1be214642ca44456b40f90672931eac6d85892b9228df40317c95fd75c975e5709a3b3619
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYUBIOpx7fXTnXTyCJWv+Hjpm3FIgcQblx:Wq4w/ekieZgU679TpJA+DpmkQblx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4936	6F63.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4936	1296	a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe	82
PID 1296 wrote to memory of 4936	1296	a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe	82
PID 1296 wrote to memory of 4936	1296	a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\6F63.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F63.tmp" --helpC:\Users\Admin\AppData\Local\Temp\a78283f33c326f2ea3ffd727d0e4bd84_mafia_JC.exe 00C6385EC49D2E9190CFCFE1B8164BB2F45ADB76EC45F8B18E89AF2FD752ACD38590DE7BF106FEE1AD80E75F8E1EB844263522F99ED4C6D792951BFE8806DB41
  2⤵
  - Executes dropped EXE
  PID:4936

C:\Users\Admin\AppData\Local\Temp\6F63.tmp

Filesize
414KB

MD5
084ada884be73420ba77e41938162783

SHA1
1485f021e4309072ffcb80efbd8cfad2aeb3fe48

SHA256
9d4a44fb490653374267d132c33b112e60e95c3e14c39dfbdf0e1890917fd319

SHA512
0d1eb43d6c6ee5319c1e8a5fa44e2b2b9f0f0d076f67c024ae8491082281c67607e72ddec06a65ce07daa74ac66de1e335d80806b5bf2c55da43b49c5b1a5e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\6F63.tmp

Filesize
414KB

MD5
084ada884be73420ba77e41938162783

SHA1
1485f021e4309072ffcb80efbd8cfad2aeb3fe48

SHA256
9d4a44fb490653374267d132c33b112e60e95c3e14c39dfbdf0e1890917fd319

SHA512
0d1eb43d6c6ee5319c1e8a5fa44e2b2b9f0f0d076f67c024ae8491082281c67607e72ddec06a65ce07daa74ac66de1e335d80806b5bf2c55da43b49c5b1a5e85

Download Submit