2962454443c5157ad4838a503ff7af7722830887179101f570aad07cd814b5fc

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 08:48

Target

NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe
Size

465KB
MD5

37ee5b71460f3ce99fc16667a675c4dc
SHA1

5a09c1fc7dd1abac5c8e9ab0db09c7d6c85f6502
SHA256

2962454443c5157ad4838a503ff7af7722830887179101f570aad07cd814b5fc
SHA512

63f42ada1f67403ddba3643429b74afaac56f839bd0d6989886b4c3a4013b84d1527f3ff7aa1d4bce0d102ea53d43feedf4fcba4cad2683985fdee86ce6458dc
SSDEEP

12288:Bb4bZudi79LOQ9IO8X+y+RGtsOkCJKyA:Bb4bcdkLOQHdyhsOkCJ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2080	B1D2.tmp

Loads dropped DLL 1 IoCs

pid	Process
2216	NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2080	2216	NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe	28
PID 2216 wrote to memory of 2080	2216	NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe	28
PID 2216 wrote to memory of 2080	2216	NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe	28
PID 2216 wrote to memory of 2080	2216	NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\B1D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\B1D2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_37ee5b71460f3ce99fc16667a675c4dc_mafia_JC.exe 8D2F2288E76A83EFFD0DECE678FAB1C18C0AC709D8D8537BA4ADBB07004CE9E25A6C0B3C2529B93055686AF603AC31E3887CC6EC00AC35EF25BAB2F76F10F474
  2⤵
  - Executes dropped EXE
  PID:2080

C:\Users\Admin\AppData\Local\Temp\B1D2.tmp

Filesize
465KB

MD5
d04cb5885d64d6f679e01c38fa6866f7

SHA1
ac507ab2ddd2300a6a302ce4a4cd41acb459e302

SHA256
b80ced7d31a259085a2e72f3f93aabb0616da1f9e0bf3ee72ea6d43e073edde7

SHA512
0fae043614eaa728861bc641c45b60a692251ede9d05ab770cd47bb17c63c738baffbe02af099222b25f600a54b90705002e41d73fc8ec7017508b07e59f0d0d

Download Submit
\Users\Admin\AppData\Local\Temp\B1D2.tmp

Filesize
465KB

MD5
d04cb5885d64d6f679e01c38fa6866f7

SHA1
ac507ab2ddd2300a6a302ce4a4cd41acb459e302

SHA256
b80ced7d31a259085a2e72f3f93aabb0616da1f9e0bf3ee72ea6d43e073edde7

SHA512
0fae043614eaa728861bc641c45b60a692251ede9d05ab770cd47bb17c63c738baffbe02af099222b25f600a54b90705002e41d73fc8ec7017508b07e59f0d0d

Download Submit