003f2bd2899f54a0acd1d2735fec60ff409cc0ca2b384df6cf0cbd195a28dcba

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 21:20

Target

NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe
Size

428KB
MD5

cc3a6d718033af4f957de871a418eb24
SHA1

42ea1a020220bff9c43d9f8f37d0d2c8178e19b4
SHA256

003f2bd2899f54a0acd1d2735fec60ff409cc0ca2b384df6cf0cbd195a28dcba
SHA512

45887f5577ef4ca76feb816bef09182ce9b9883ebf019f1132aaf91fe8ae3d8ac1809391778b74c20bbd4e05bd69a20ed654ded9edecc781d2a372089d78ae51
SSDEEP

12288:Z594+AcL4tBekiuKzErV4Kw12Knpji5GLG2OVpDLlWfadl:BL4tBekiuVrgNnp8blWfE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4836	2352.tmp

Executes dropped EXE 1 IoCs

pid	Process
4836	2352.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4836	3584	NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe	91
PID 3584 wrote to memory of 4836	3584	NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe	91
PID 3584 wrote to memory of 4836	3584	NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\2352.tmp
  "C:\Users\Admin\AppData\Local\Temp\2352.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_cc3a6d718033af4f957de871a418eb24_mafia_JC.exe B5AEDBC3384B8F1E2C2A8376BB93618B77E36647259181A0B48919E387E1D7E1072A3D4D2172447EEB85077ED960A92431C05F508971BFBC6F8499F7A2896DA0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4836

C:\Users\Admin\AppData\Local\Temp\2352.tmp

Filesize
428KB

MD5
be29b4566c131f4fedccb61d3a9c5690

SHA1
68c1ea740750506f0517e3111b18a8252279c54b

SHA256
1861723852a2cdd1a5934d15c4a8f890dda74cb8fdedd1d49b9e984f787d3b2b

SHA512
d35f8d87c635e245031c385286185230b5c1ca0e402506087a042c858cb17e7c7a755360c6552b5b77ae59520a9ffbe9190d74e7f9ba3a1f178596797ba9c0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\2352.tmp

Filesize
428KB

MD5
be29b4566c131f4fedccb61d3a9c5690

SHA1
68c1ea740750506f0517e3111b18a8252279c54b

SHA256
1861723852a2cdd1a5934d15c4a8f890dda74cb8fdedd1d49b9e984f787d3b2b

SHA512
d35f8d87c635e245031c385286185230b5c1ca0e402506087a042c858cb17e7c7a755360c6552b5b77ae59520a9ffbe9190d74e7f9ba3a1f178596797ba9c0de

Download Submit