bec0b89276f5b60687ba968d29207a4e91263197c8816c3cf6b0881986d0cd19

Analysis

max time kernel
127s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 18:17

Target

c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe
Size

414KB
MD5

c5351cf7afce617a334fced11cbc3b8a
SHA1

0046b8c219c6715450ff88a93f442a010435efda
SHA256

bec0b89276f5b60687ba968d29207a4e91263197c8816c3cf6b0881986d0cd19
SHA512

a2cba08d0a4ac2c7aca08473ecab57ccca21036f3128852bc4daab914668793263edb40c79bee13dceac01c4c1e10ab2103034a3d3014e25b18f362405942655
SSDEEP

12288:Wq4w/ekieZgU66mmCwxfnHm+M+XdHR0b1bqVlx:Wq4w/ekieH6iC8fG+Xib1bqVr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4776	CB6E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4776	2452	c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe	82
PID 2452 wrote to memory of 4776	2452	c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe	82
PID 2452 wrote to memory of 4776	2452	c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\CB6E.tmp
  "C:\Users\Admin\AppData\Local\Temp\CB6E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\c5351cf7afce617a334fced11cbc3b8a_mafia_JC.exe CAFFDB68EE59B8B6D3DF483F8CD25B34159BF2E1AC3001B425E642483022EC79EC7EFDE8DD893E951017E6EE7617E1655F68668A62211ACB5E0282FFE75C22E7
  2⤵
  - Executes dropped EXE
  PID:4776

C:\Users\Admin\AppData\Local\Temp\CB6E.tmp

Filesize
414KB

MD5
2e17cef02d75295bd3091a8aac5ac496

SHA1
7203fb587cf60b335447d0c8a23102e89f14d65f

SHA256
cbc9f0c4c62db452149424f980f3e7dd12cd6344668e5e25cfa5d88af033784e

SHA512
beb51ffae7306b55abb5dd9cbb0edeb903dd437107a1dbe0a038e7f27b537d5cab9b37cbfed022ad05ac661b1ede090560b8b4f5126809a514a0cebc5b454966

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp

Filesize
414KB

MD5
2e17cef02d75295bd3091a8aac5ac496

SHA1
7203fb587cf60b335447d0c8a23102e89f14d65f

SHA256
cbc9f0c4c62db452149424f980f3e7dd12cd6344668e5e25cfa5d88af033784e

SHA512
beb51ffae7306b55abb5dd9cbb0edeb903dd437107a1dbe0a038e7f27b537d5cab9b37cbfed022ad05ac661b1ede090560b8b4f5126809a514a0cebc5b454966

Download Submit