5ef98d99301f3ede42c2ae18c34eed77c6a6119ef630dcec069c3d1203f9cf19

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:18

Target

2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe
Size

428KB
MD5

eac5c26d3952a000df874acaa01a6477
SHA1

9fb88793d52429de8027808055dedea8aecbcd27
SHA256

5ef98d99301f3ede42c2ae18c34eed77c6a6119ef630dcec069c3d1203f9cf19
SHA512

ad31085dddb7bb7043cfb3d0a83c12c4b0a98d04bb1300559aa407c23631bf8b2c17b226943378ecade7868e8b344daff8d34bdd12f93e0171ad4341159f8444
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mF7qTgcqhsSmW0ZCkLa81KjS8Wuot2qHR:gZLolhNVyEX0Lh8KD81KjS8WV2qHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1476	468E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1476	468E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1476	1492	2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe	88
PID 1492 wrote to memory of 1476	1492	2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe	88
PID 1492 wrote to memory of 1476	1492	2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\468E.tmp
  "C:\Users\Admin\AppData\Local\Temp\468E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-06_eac5c26d3952a000df874acaa01a6477_mafia.exe BC13CCBE743A24AC5366FE795A92CCFE4DCA4FCAA0261DE69757735A7DFD8B753CD56B5D72D4EAB57A7930F6CBC0349DF75B8FD9BF3A93F2D0FCC976F398A5D2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1476

C:\Users\Admin\AppData\Local\Temp\468E.tmp

Filesize
342KB

MD5
f148d4116018459dbcad0a3431bd2e0a

SHA1
1bb3d46080b166f1ac651144c74487cb2297b07c

SHA256
ff75eb9b01759495e4e43a4c34d745335cde2a8c504e851e7bf6c7b5cf5f9b45

SHA512
95887bd1ea1552d4c7c4e0889be94938caf52192d935377ea44d4e90ec597cf025e27361c59664ba51719e89c5f6b04a8cf7b75b3e6809d04086ae734bce816f

Download Submit
C:\Users\Admin\AppData\Local\Temp\468E.tmp

Filesize
192KB

MD5
df474335296efa4c3ac8f2edee344c53

SHA1
64151fc36901b709a4412fc24421982f53d0153a

SHA256
809a1d95b0da1e0bd77c2a7906b51e20cfc768f90ad774260fe94cf977b77949

SHA512
90a649775403f232304edf67448cf0b01930923846d701e3ed0d5dacb62427097faeaa3c3e38e1d0eda776f270ead1833f72b79cec9fce39aee0e93b9f6b4021

Download Submit