7ff3c4d094e5b4054f15005ac249a76e97a7c288f20d9fe0d5a4f5312f5f5f38

Analysis

max time kernel
148s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:46

Target

2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe
Size

412KB
MD5

b532f01c2d12f3cbc1120b15d65912d2
SHA1

53027dfbc171a21e7cbe6d7b249098b6721ccaf7
SHA256

7ff3c4d094e5b4054f15005ac249a76e97a7c288f20d9fe0d5a4f5312f5f5f38
SHA512

e5f9bc0d6e87caf6b054582a89dafda99ada4d9c08859d8df97e972965284ff4c0f04005d465b66cce80b7a6713b748dd89db4a551035375e1bb98b8f81a50fc
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnyPr3MeHNJoXwWIphHdn3kxb+l9p4BFTNP:U6PCrIc9kph5yZH0gDn3Q+lr4vF

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5108	4853.tmp

Executes dropped EXE 1 IoCs

pid	Process
5108	4853.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 5108	1244	2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe	16
PID 1244 wrote to memory of 5108	1244	2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe	16
PID 1244 wrote to memory of 5108	1244	2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\4853.tmp
  "C:\Users\Admin\AppData\Local\Temp\4853.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-08_b532f01c2d12f3cbc1120b15d65912d2_mafia.exe F6318C142AAC180033FA958200F6716B4BBF0E08DED7E086DFC392EE9A9F837D107EABBE75886C01C8C1181EFAE0CAEE04EE7681A235080B1177BF854F392C4F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5108

C:\Users\Admin\AppData\Local\Temp\4853.tmp

Filesize
92KB

MD5
66024178ee8392ef0a67f306c0b4e62b

SHA1
2ef498cdfeedf046507c31df14730fd691b97e01

SHA256
4a4b38bec5d3d9f249fc24e109eb76b518e704092e908f53f8ae97eb5a1a585e

SHA512
aa5f82ae6e43d9099b830a053c3e1880741a20b11d4102b1d485338b8f34b725b3f7b97e1582b3ff1bbdf6502430f90027dbddd7843c196213bcb20463ec011a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4853.tmp

Filesize
3KB

MD5
8ebc795ddde2302955cd2b22aa7edded

SHA1
92c4409fa57d3c827ec2f81b1a78eb97b597c92c

SHA256
3c314284deb70b47f8938459bd21a9b80329e6c7cde214977485513407e231a8

SHA512
9c538e2ab1701ef6715e519bc620a4a11478562df4286dce783aabf8ab14dcebfcffda21a8ed230c168aeb43fb0e77522c923174aa67e1f6968c632131a201ae

Download Submit