df5613c0408d4d826289f47be380f4e72d1e282797008e33b78087547ed08884

Analysis

max time kernel
146s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 05:53

Target

2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe
Size

433KB
MD5

f4b843bc1962f0e86f77dd042a22e2a4
SHA1

008d018ce3dad269209c0e38ac034029e4070a0f
SHA256

df5613c0408d4d826289f47be380f4e72d1e282797008e33b78087547ed08884
SHA512

704a2bdada279705b060cd0eb3ea4337f306123b0e6612df2f0590822e07e8431e4d7b36cd9f9b28944d5d592635f2b3873dadc3c8354daadab7ca5fcd5037c3
SSDEEP

12288:Ci4g+yU+0pAiv+JSndL6ZXLyPYHIip/VzV5Nln:Ci4gXn0pD+JZZ7yPaIiphNd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4384	ADD4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4384	ADD4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4384	3568	2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe	24
PID 3568 wrote to memory of 4384	3568	2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe	24
PID 3568 wrote to memory of 4384	3568	2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe	24

C:\Users\Admin\AppData\Local\Temp\2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\ADD4.tmp
  "C:\Users\Admin\AppData\Local\Temp\ADD4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-01_f4b843bc1962f0e86f77dd042a22e2a4_mafia.exe 5111CCAA733FBB20746B19C27C62253F9B66F62A8C1624498F2D882EEA6FE7838E4F9AB6221C6A5046F18014173D9BD52C669D76FA000031D0E02AB33E69F4B4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4384

C:\Users\Admin\AppData\Local\Temp\ADD4.tmp

Filesize
1KB

MD5
c318f438b6453912f8ca4a00502db63c

SHA1
5b4cc1378d34ed3601eb5a2718b3643cf7ffd3ce

SHA256
3ed3a1bb9f8fae61e9ec8284851b65052bb4a94dc6b5933393b3c37bdfadc744

SHA512
ab3632a2d64d69b2e9e7549e29c6ca779f4ccb2d83efb00d410b1472321ed43e0db98556abd1c12dcaea55077e073a036b11499553e7a39cef2b08c053dd41db

Download Submit