a57de947d40f04c1f9e39c38dfbbb59969dcb48729e15c4d1e7fad3ae0c953a3

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:50

Target

2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe
Size

411KB
MD5

fa66cd30d574746837d6e8b3106cfbef
SHA1

b1f0fcf7d37e17e4c9d8c4a2fdd67945596e27a1
SHA256

a57de947d40f04c1f9e39c38dfbbb59969dcb48729e15c4d1e7fad3ae0c953a3
SHA512

2ee98a1f6a4f0dd5355eda15a96522c5b76412836ab6cce328600c771935c7be4d2c87f470889ee882bf497041a60fd4dc08205a2d6c91e59fece3a8c97a07d7
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFXfFJClr+h9k8Ffny99v/u8MVxxqHI:gZLolhNVyEgphnWv/9uDqHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1956	66F7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1956	66F7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1956	568	2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe	88
PID 568 wrote to memory of 1956	568	2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe	88
PID 568 wrote to memory of 1956	568	2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\66F7.tmp
  "C:\Users\Admin\AppData\Local\Temp\66F7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-08_fa66cd30d574746837d6e8b3106cfbef_mafia.exe AC88148247219FE2D1FFA81EDA672AC69E903159134A24EEFAD2C311963CC64F09F9B04737EF4BEE37CFE8466978CAA8EF6E6C7B1F639834B30BE7AB699C971F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1956

C:\Users\Admin\AppData\Local\Temp\66F7.tmp

Filesize
411KB

MD5
eaee4d2ce0d5cc53a85c215872da0389

SHA1
182b4e86abf4ccdb32ea1a82090e23d2bca036eb

SHA256
6a2be8af5b07364ebd07563143bcf03f8d422a38bffa4f9c91464a580c7b2343

SHA512
65d157ba8a0fc628d2f2bec3c9634acf89d783321b9fa038b98c35ee1270c0bdb73aaa19ce05509848b0746a85064459e8ce66876cc49e60c6df0d143a9eb865

Download Submit
C:\Users\Admin\AppData\Local\Temp\66F7.tmp

Filesize
365KB

MD5
8a882aee0dab29102a192101b4198935

SHA1
10ffbb10da1b0e426b929c27cd9b053c5fd50232

SHA256
e72f481d9cb7cfa3f8dca54f4c886dfbb9ca31de99b1e8a25083ee9d34c29dd5

SHA512
9fe9b934653548db929056ceb40d7c7ab84cfd8e7d9220cf83157ec7b86a930c6b5ec82cdd3968c1284cab3927a432e5061150cf8ef83f18f54197e6f5734a3f

Download Submit