c3752cbf1cac0439843e17d4d1180190e582350b365c9e651c7478170e6e89a5

Analysis

max time kernel
144s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:52

Target

2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe
Size

486KB
MD5

3b120d28b524ef8b3b23c4399a741db8
SHA1

c95a4d325e405eaf6aadfbf112204990b07119b1
SHA256

c3752cbf1cac0439843e17d4d1180190e582350b365c9e651c7478170e6e89a5
SHA512

137cfa3524cbad052c788a5776ea4939c04de164336ced2164dcc6353c39316642f7ed3dfc133210f9a2334d24dde906d709a2582e4be657ff3588faa143ec37
SSDEEP

12288:3O4rfItL8HPSFD5sbIfDGB6VjGf7rKxUYXhW:3O4rQtGPa5sbQGJ3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4672	AB44.tmp

Executes dropped EXE 1 IoCs

pid	Process
4672	AB44.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4672	4740	2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe	87
PID 4740 wrote to memory of 4672	4740	2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe	87
PID 4740 wrote to memory of 4672	4740	2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\AB44.tmp
  "C:\Users\Admin\AppData\Local\Temp\AB44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-09_3b120d28b524ef8b3b23c4399a741db8_mafia.exe A4F59040221E220749DFA982F221DDF748C24093E0D2FF48C412BD26A5E3869835892040AD216E921F13F5AF61EDE8BB427F2FC86C0696F26EE906BC5BC12F9B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4672

C:\Users\Admin\AppData\Local\Temp\AB44.tmp

Filesize
486KB

MD5
bf125ed48afcfe90a80a49e9d7f825cb

SHA1
705b97a008b30f061ce1184c1b57425719dadd52

SHA256
e6f11ab4094accfe4d0d36e66433483c32f44dc23bcb451f844908ca18a32019

SHA512
542e15e0b3ce5c761b5f6bbbf0fc50cb1e23ba424d6754ce6bb33044d57aa7c17a99cca2e427f1c11fda75427ad0c92e2fe82aca3ca6edc2ed7cfd476cb9ed9a

Download Submit