ed4c2ed5e025a2d9684b197f0f417487e9b54be5706c3ca581889d2bc2cbea01

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 15:38

Target

NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe
Size

384KB
MD5

746781e71371cec3a564b562e29a3351
SHA1

b80b62e4998a7e1628d436f9f124329d9c6fa4ee
SHA256

ed4c2ed5e025a2d9684b197f0f417487e9b54be5706c3ca581889d2bc2cbea01
SHA512

50274c337b1b70457362c618a768a92a6987c52d0e7c2a93c9a0c0b6ffb536b06647a5c52e7b83d50a399146641cb182ed3ba6c15df23f2dadd75be90e83d520
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHg5sWZuwJjbCYjOj3FOHvC+CSuzosvsWlB6Z:Zm48gODxbzNWZuwhNG3qvCqTWSZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4056	A057.tmp

Executes dropped EXE 1 IoCs

pid	Process
4056	A057.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4056	2428	NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe	86
PID 2428 wrote to memory of 4056	2428	NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe	86
PID 2428 wrote to memory of 4056	2428	NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\A057.tmp
  "C:\Users\Admin\AppData\Local\Temp\A057.tmp" --pingC:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_746781e71371cec3a564b562e29a3351_mafia_JC.exe 25028F9460AE947497E0C2DE3DE09DD54F07D4A05B97E9F82E67E0F955FC2D5D6AF2BC38BD1E8107F25808734C07BC3D1F629E744F6DF81FA7506DAA60C340F4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4056

C:\Users\Admin\AppData\Local\Temp\A057.tmp

Filesize
384KB

MD5
a6881c7d1a8ff20a30cb557944cf176f

SHA1
9b9ecf2a1a8c394ed1df72b4b43b9ad0bac9021d

SHA256
38171bcc61ff92f119fec420f7db55da4511eff387efb4cb72be79467823cd06

SHA512
8dc3feab5585996337cc87fa4a54a832706c25243491d2610466cd937123e0374402a011a6d6dc4a1abae629d05a1987484d021925b7e38cd54e1ee5cc5cd752

Download Submit
C:\Users\Admin\AppData\Local\Temp\A057.tmp

Filesize
384KB

MD5
a6881c7d1a8ff20a30cb557944cf176f

SHA1
9b9ecf2a1a8c394ed1df72b4b43b9ad0bac9021d

SHA256
38171bcc61ff92f119fec420f7db55da4511eff387efb4cb72be79467823cd06

SHA512
8dc3feab5585996337cc87fa4a54a832706c25243491d2610466cd937123e0374402a011a6d6dc4a1abae629d05a1987484d021925b7e38cd54e1ee5cc5cd752

Download Submit