26e20facce0ba52027a229b4ac51b30c826a3d0842a0ab004bab5234c3509e22

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 17:10

Target

c1737db9fc9d7319498eea537c318393_mafia_JC.exe
Size

202KB
MD5

c1737db9fc9d7319498eea537c318393
SHA1

486306b80d73391afc2cc0e086c22a2b985846f1
SHA256

26e20facce0ba52027a229b4ac51b30c826a3d0842a0ab004bab5234c3509e22
SHA512

68e2d75b3b65f8115d43812204372a2a451198da133320ae66d838e6945e20b2a791e8f4008424a0b48878baf296b98fba2f98f91d81baeff946108e6c3126b5
SSDEEP

3072:k9JD6dMe6tW/T2Je+P+IjSHlUU06wjwRPbrri8myg44eX:C6dp6Q/TxMDU0twFrrBmtnk

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1364	c1737db9fc9d7319498eea537c318393_mafia_JC.exe
1364	c1737db9fc9d7319498eea537c318393_mafia_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4352	1364	c1737db9fc9d7319498eea537c318393_mafia_JC.exe	84
PID 1364 wrote to memory of 4352	1364	c1737db9fc9d7319498eea537c318393_mafia_JC.exe	84
PID 1364 wrote to memory of 4352	1364	c1737db9fc9d7319498eea537c318393_mafia_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\c1737db9fc9d7319498eea537c318393_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c1737db9fc9d7319498eea537c318393_mafia_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c EXIT
  2⤵
  PID:4352