e20b8b67e3be5dcdad4b42de23b42ed22dd31713e1690dd50d70f1fdda9fe0e0

Analysis

max time kernel
126s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 19:14

Target

2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe
Size

428KB
MD5

1a8d38a1cc7c7192dedaa140306bbcaa
SHA1

4b275b92249167ae662a35374ee2513d4d105a07
SHA256

e20b8b67e3be5dcdad4b42de23b42ed22dd31713e1690dd50d70f1fdda9fe0e0
SHA512

e0296e9c4f3db30da9d685d2dc0b1a0b7653506e73d1693d377c419357893b92c553089df0e19ebd2f87c8395f3b467e470537b781cb7ba11b840cd8f7845fc7
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFtcMw7cYGRJYDYvR4oz6dAek1ZktQLD4BmqHR:gZLolhNVyEp5cYGR8oufy+yqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4908	C999.tmp

Executes dropped EXE 1 IoCs

pid	Process
4908	C999.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4908	972	2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe	82
PID 972 wrote to memory of 4908	972	2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe	82
PID 972 wrote to memory of 4908	972	2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\C999.tmp
  "C:\Users\Admin\AppData\Local\Temp\C999.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2023-08-26_1a8d38a1cc7c7192dedaa140306bbcaa_mafia_JC.exe AE78C1663510111E30286402126E548DE0372F2C02FD9CC6F30F023907BBD1608CFD0498CB992D947E4896F7786D0A7A301FBABFBCD5CDDC552B3A35CAD7B631
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4908

C:\Users\Admin\AppData\Local\Temp\C999.tmp

Filesize
428KB

MD5
8fd0497c02bcb4fd1ce70e352b9118eb

SHA1
81a4dfae0cb63f90a542d4befee432f3b8e5ffce

SHA256
feecdce0eadfb7370b85651e8db5764034b31a2976fac787cc7326b4b6f4ea47

SHA512
09c0b463d966e024b812c6dc223dd7ee441b446e7297dd414c6b4942d1de6673fc94d17efc9d6cb7baa85558c3f99f29820f0db7cc86288337a2783d5f2274ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\C999.tmp

Filesize
428KB

MD5
8fd0497c02bcb4fd1ce70e352b9118eb

SHA1
81a4dfae0cb63f90a542d4befee432f3b8e5ffce

SHA256
feecdce0eadfb7370b85651e8db5764034b31a2976fac787cc7326b4b6f4ea47

SHA512
09c0b463d966e024b812c6dc223dd7ee441b446e7297dd414c6b4942d1de6673fc94d17efc9d6cb7baa85558c3f99f29820f0db7cc86288337a2783d5f2274ae

Download Submit