185b08fae3c7f396c24573d212131175ccfda559dbce36d533e9e2df489c51b8

Analysis

max time kernel
169s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 19:16

Target

2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe
Size

412KB
MD5

1368c497c6dfee32c1616c5b7685e6d6
SHA1

0bac08e8e56b12212ae051fa8daaff4cd7a2121e
SHA256

185b08fae3c7f396c24573d212131175ccfda559dbce36d533e9e2df489c51b8
SHA512

a9504f8a7ee9587d6574cdf528d29ef5fa062b943db277972f94211291c6bc44c76b9c2cccea3a51f1458b7edb4280f4586967fb926784f275c5c4c71fec006e
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZn75uOIDtH4tUC6InwI8iogORJf7gzib7uP:U6PCrIc9kph5YDlgJnbogO7fMz2K

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1984	433E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1984	433E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1984	2908	2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe	84
PID 2908 wrote to memory of 1984	2908	2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe	84
PID 2908 wrote to memory of 1984	2908	2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\433E.tmp
  "C:\Users\Admin\AppData\Local\Temp\433E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe D1B7F68E2EC428BBC0C5FEC196EC8496D50661E412C9DEB24D9841F748E6B6B166C8AD7B93CE0E4CC3C0EE8404FE5C2DA5FDAFEE3A25BF8084D6350CF5CFF96B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1984

C:\Users\Admin\AppData\Local\Temp\433E.tmp

Filesize
412KB

MD5
3a43902bc98d74523f7459b9529a5ebc

SHA1
bd39d5187f4410e3fa424beb61b60f7336c5f7b2

SHA256
b770f509ebea7b85678822d08710ca5643fb5d47022e479fd8cbf449b7745480

SHA512
7b7cd267adcd8cfccd93804a5122d3c1bedcba4174694577bde9b481f7322d0e538ca55418453d16447e3753d248996892e4afe647ea1a227a9ea895586e8211

Download Submit
C:\Users\Admin\AppData\Local\Temp\433E.tmp

Filesize
412KB

MD5
3a43902bc98d74523f7459b9529a5ebc

SHA1
bd39d5187f4410e3fa424beb61b60f7336c5f7b2

SHA256
b770f509ebea7b85678822d08710ca5643fb5d47022e479fd8cbf449b7745480

SHA512
7b7cd267adcd8cfccd93804a5122d3c1bedcba4174694577bde9b481f7322d0e538ca55418453d16447e3753d248996892e4afe647ea1a227a9ea895586e8211

Download Submit