f58e652844a17d59f8ea876f4b364abef1de149dad70603507f324ff0ebdf50a

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 17:28

Target

NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe
Size

414KB
MD5

4063860aab5c8b93ac9702699865c6c8
SHA1

0c0565c8b567e415d4221bc27ca65167eb22413d
SHA256

f58e652844a17d59f8ea876f4b364abef1de149dad70603507f324ff0ebdf50a
SHA512

6f9ac5d13f17179cd5a2ecc547b54a5ac7c25e068f028a6ee1f0ed7b3878b14cf6e76b3b5bf4c83131e01b03163b8f14e995edb2b8944569bc5ed71da6a86d73
SSDEEP

12288:Wq4w/ekieZgU616MSpPI300ch+6is+HeBXelx:Wq4w/ekieH6AFYch+zs+yur

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4156	3B2F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4156	3B2F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4156	2980	NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe	88
PID 2980 wrote to memory of 4156	2980	NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe	88
PID 2980 wrote to memory of 4156	2980	NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\3B2F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B2F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4063860aab5c8b93ac9702699865c6c8_mafia_JC.exe 687AB04584629000F0DDDEA73B7B77FAA8358E09BD534959CB35327FD9758AD13DC79CC661E861A98DF7E6B3E38C75A456CBD6F1D422A873FF9F460BC9442E89
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4156

C:\Users\Admin\AppData\Local\Temp\3B2F.tmp

Filesize
414KB

MD5
7a4caebdcd7ffd663546efb759e1dafb

SHA1
a63ca219134dcae4ff90e08d7fb0517e600be96f

SHA256
f740585fe5d15e8960015e28a8ecd58ca7b92d95e15c357247f7459c601ee7e8

SHA512
9812713bde48f2cd00b3421730a17788d08f245d69b67a2893870b9bf08babbd4f0e316593477f165da2af63566aa6137c8d0817f8b0de3ebad5cd552afc547d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp

Filesize
414KB

MD5
7a4caebdcd7ffd663546efb759e1dafb

SHA1
a63ca219134dcae4ff90e08d7fb0517e600be96f

SHA256
f740585fe5d15e8960015e28a8ecd58ca7b92d95e15c357247f7459c601ee7e8

SHA512
9812713bde48f2cd00b3421730a17788d08f245d69b67a2893870b9bf08babbd4f0e316593477f165da2af63566aa6137c8d0817f8b0de3ebad5cd552afc547d

Download Submit