cb9af880824f935c745ce0aad8a5f1e2a48193f0875b704adeb4db0dc8c60174

Analysis

max time kernel
123s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 18:03

Target

NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe
Size

444KB
MD5

1fa3a597e2f4529827e6704ced857e6e
SHA1

a63c3b717165c6600937dcb069e5616ecd76a40c
SHA256

cb9af880824f935c745ce0aad8a5f1e2a48193f0875b704adeb4db0dc8c60174
SHA512

26dead34bcf9c18742261892d8d9d51d685c4910029abac04a05b6ad034ee5b194663a95695ca3147cdec140823ea052279f4d172d51ed74c07faffbfc81f44e
SSDEEP

12288:Nb4bZudi79LEWN2LYzGoxuIujRw/mhWqSA:Nb4bcdkLzNUFwu

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1060	B892.tmp

Executes dropped EXE 1 IoCs

pid	Process
1060	B892.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1060	376	NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe	88
PID 376 wrote to memory of 1060	376	NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe	88
PID 376 wrote to memory of 1060	376	NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\B892.tmp
  "C:\Users\Admin\AppData\Local\Temp\B892.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_1fa3a597e2f4529827e6704ced857e6e_mafia_JC.exe 4AFB1A01EAE14AF1674FC64560B228377CEFC87F6D499D64CE0FA719EFB98A08E75A1DA457F05F17CEC4696D4EFEC9A8BF33C604F9824FCE08503FA4C981346F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1060

C:\Users\Admin\AppData\Local\Temp\B892.tmp

Filesize
444KB

MD5
767e043140c2775d0850c5dde700af1f

SHA1
150e84da4fd6c8031e33204249d4425569fcccc3

SHA256
582c84ca9572b34472424e6db36fdb171f5d6efb12ee8e4c24c6d0f8d0183124

SHA512
2b4c0cf143a3b37febc8da029286039f36daff8f259e49ec90c2cd27bddce85bdbaefe850d76fac606a1f3a7a315171ae3c5e97d99c22b9d35c97d7bdf64816d

Download Submit
C:\Users\Admin\AppData\Local\Temp\B892.tmp

Filesize
444KB

MD5
767e043140c2775d0850c5dde700af1f

SHA1
150e84da4fd6c8031e33204249d4425569fcccc3

SHA256
582c84ca9572b34472424e6db36fdb171f5d6efb12ee8e4c24c6d0f8d0183124

SHA512
2b4c0cf143a3b37febc8da029286039f36daff8f259e49ec90c2cd27bddce85bdbaefe850d76fac606a1f3a7a315171ae3c5e97d99c22b9d35c97d7bdf64816d

Download Submit