aeea91e489d6d5f76170aa2c025deb4e5d6c3c02262a601e6f37f77cd6f58dcf

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 20:19

Target

NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe
Size

414KB
MD5

77a78f8673a5a45244c62dc5391e7000
SHA1

5dd4613202f8a0928d58b897b015cb3cbc25f3d7
SHA256

aeea91e489d6d5f76170aa2c025deb4e5d6c3c02262a601e6f37f77cd6f58dcf
SHA512

da882a34ea5082cc078a1d82b93269769279adc56b8b38bd01ba73fb14bb8e0e1d3d6b3103ce3389170e6ae62b76e8b6c779684b4843e1f908494a426ff8923e
SSDEEP

12288:Wq4w/ekieZgU6b+rliDsycH1UUjNC92WQplx:Wq4w/ekieH6KrlbJU2yTQpr

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4740	FE36.tmp

Executes dropped EXE 1 IoCs

pid	Process
4740	FE36.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4740	2648	NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe	82
PID 2648 wrote to memory of 4740	2648	NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe	82
PID 2648 wrote to memory of 4740	2648	NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\FE36.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE36.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-04_77a78f8673a5a45244c62dc5391e7000_mafia_JC.exe 94D9682B267F9ED307A2574DA52CB5E51B5B4B589545479E3A23777D792C80357E2DA6C0CB2D5A27F11CC7EFE11B2E152D4787A1A4209926A190E9AEC6521C08
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4740

C:\Users\Admin\AppData\Local\Temp\FE36.tmp

Filesize
414KB

MD5
38b8a7ee2426ad12423d1219b7cafbb1

SHA1
344da169fc94c58fda96112559842c9017142de4

SHA256
a85cb5f2149ce6208bcbd53f2fda7ae366022819e122bbf36d5b25dbcbed59bb

SHA512
b540b4eafdd769894bd4ac231b7bc229a18e513b2fb589ba0679fd0126546324208313f83192ef2e2ea2e8116c4f39c657538ea9ce037b77db370c272c24723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE36.tmp

Filesize
414KB

MD5
38b8a7ee2426ad12423d1219b7cafbb1

SHA1
344da169fc94c58fda96112559842c9017142de4

SHA256
a85cb5f2149ce6208bcbd53f2fda7ae366022819e122bbf36d5b25dbcbed59bb

SHA512
b540b4eafdd769894bd4ac231b7bc229a18e513b2fb589ba0679fd0126546324208313f83192ef2e2ea2e8116c4f39c657538ea9ce037b77db370c272c24723b

Download Submit