d0bc2cf8c761dbcc9dd594a7f6d17d6f14fbfe8e72c1a0e77f51d55242a9942a

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 05:50

Target

2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe
Size

433KB
MD5

c797be449e27eb7855c8923ad5e1c1d1
SHA1

d3ad6893fedb751aeeac848a034666ce422c7978
SHA256

d0bc2cf8c761dbcc9dd594a7f6d17d6f14fbfe8e72c1a0e77f51d55242a9942a
SHA512

6f755869384a1180708d5f374969abf4d9488403f37039f71af1112da6e5dea24c5f6d718c655e4d55f75f5605aee9a987dcdce9a27aa289f04c18d0211b1777
SSDEEP

12288:Ci4g+yU+0pAiv+MkB+C6EMjzQY9hw0u7ZtHn:Ci4gXn0pD+79Cjz7u7ZR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2312	49DA.tmp

Executes dropped EXE 1 IoCs

pid	Process
2312	49DA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2312	4532	2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe	88
PID 4532 wrote to memory of 2312	4532	2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe	88
PID 4532 wrote to memory of 2312	4532	2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\49DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\49DA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-01_c797be449e27eb7855c8923ad5e1c1d1_mafia.exe AF43A050AC9F0029D2AAB60EC02D7DE6C8176165B361DF59F543D7B385A1F485B4CA13D03185EB43D58F08EEEDFB2A9FA99704000A2069998AA5BE3AE9994385
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2312

C:\Users\Admin\AppData\Local\Temp\49DA.tmp

Filesize
433KB

MD5
ae461e0e97a36455ac3cc2b7f2506ec9

SHA1
458d8e7f4bc383c86d2ba4b68bf60943b9c2ec06

SHA256
8bd01925339246b9a850381b03300578fccc90b731f867a95d2eba42f94d4899

SHA512
d8652bd96505e4174d208d4c6c0b039aaab0bd02969e86bfe078f9a655be4687cacaf39b5812c25dc2e4960c7c41d13f0e2013d610d802d9c41856323ccd0901

Download Submit