a87f806d4caea84a180a94aef3217e580765aa580f1649a3f294a45f3e06343d

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:09

Target

2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe
Size

476KB
MD5

564168d8a8a6c31018c561a07c525da1
SHA1

ca3395c8c6fbaba7c0e0d9130fe585aabfb0b31a
SHA256

a87f806d4caea84a180a94aef3217e580765aa580f1649a3f294a45f3e06343d
SHA512

ad65c21faad55771bb2586edd3b995dfef8f91e6feeb2aea3c35016b87ee556176dd7c34ea45444300b589ce9934fedb4490ad5272e09d678d1c1521f9121fe5
SSDEEP

12288:aO4rfItL8HR4GmwXoZsa+cBrz426wsaytq87K9wlsDpVFd:aO4rQtGR49JNBv426X/+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4500	45B4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4500	45B4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4500	5024	2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe	89
PID 5024 wrote to memory of 4500	5024	2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe	89
PID 5024 wrote to memory of 4500	5024	2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\45B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\45B4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-06_564168d8a8a6c31018c561a07c525da1_mafia.exe ABB2431634B8667FD99C706B30392C80F0898F1DB82C12EE85F6C414E95A7CBA75CEAA7DB4155D08D175C6B50D22AB6D259E6FD314A338D3303832B718AA4D1A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4500

C:\Users\Admin\AppData\Local\Temp\45B4.tmp

Filesize
476KB

MD5
9d1721cfa8eb7b71aa9a8c55a43ad339

SHA1
e018946f49cad7a0238a120d1e37f999b6f02970

SHA256
4b1fed55cfd3682ef17909a6062b54a9a21641a2aa2fa2089e176bc6c9811b68

SHA512
deec0483d9a744591aacf79e6e556f3becc4f367684f0db6973651ce704116ccddfe604c4c846c2a113f511c8dff1c91c73b223999bfc647a2d2fb0808032124

Download Submit
C:\Users\Admin\AppData\Local\Temp\45B4.tmp

Filesize
459KB

MD5
a46a9dff7f070a3bdb384dcc6561a36c

SHA1
8098762bcf6ec8ff40115ca89c53f7b5a5252086

SHA256
627a6894d96e41963be15b3a53a1b9e9cd0a830c7f03d6374c00678f1987bc78

SHA512
b00e5e000ef95a5ab700611bfd0464b81efdc9254b372c200fab671b8bec4fa13e49f550d72464c3164c877b019408704b5e93aea5815ffb6dd120a5030afd43

Download Submit