32604001db4ba998c6862654efe455da8aa3a389da7eec13b12836aa8533eee3

Analysis

max time kernel
145s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 05:44

Target

2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe
Size

444KB
MD5

6f4ec83a2c0f9734d36080f7a2d74420
SHA1

4cbae17776aebab8900db8482657e594bbcbd584
SHA256

32604001db4ba998c6862654efe455da8aa3a389da7eec13b12836aa8533eee3
SHA512

33cf66961b794680fed006f6bc3d3ddaa1e3797279289c0419dbb2b51dd90cac4d38a4332efc9983e89da6725a8bd06cdc4a8c71ab48ca0edffe66e48e6930c7
SSDEEP

12288:Nb4bZudi79L0LF67rNKNT61vB7Nw+1IhTLA:Nb4bcdkL0LF67O61JBwgIF

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4016	47B7.tmp

Executes dropped EXE 1 IoCs

pid	Process
4016	47B7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4016	1232	2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe	22
PID 1232 wrote to memory of 4016	1232	2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe	22
PID 1232 wrote to memory of 4016	1232	2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe	22

C:\Users\Admin\AppData\Local\Temp\2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\47B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\47B7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-01_6f4ec83a2c0f9734d36080f7a2d74420_mafia.exe B73570F5C4F5D4B50FA09FF8187BE888D76863FEFC42A87FB9974FA373F9F47D4D2D8B4CAABCE21553A54DD761C303C11B1A453451932E4527FD9FF8C8573FAA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4016