44f60ab5474cbc93918258e85dcf675aedab9cd3a355c60afa1bcd22bcb0dbbb

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 05:47

Target

2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe
Size

476KB
MD5

27163a32f3c0ff56b94443ded9695b0c
SHA1

9150df7fd70115cbe09b8579d9f859b9d0835ac9
SHA256

44f60ab5474cbc93918258e85dcf675aedab9cd3a355c60afa1bcd22bcb0dbbb
SHA512

07dba706c30eb122c3a1f4a1e97d4e5e0f781975cd8d34acd61db4d6bb82992a6d55ae13f47d2fb4e6184fe2d638ca76394b8a71ee004171fa15250791041c5b
SSDEEP

12288:aO4rfItL8HRy6P1K/vSfvCJLFuuwz9lz8ooGcOS7K9wlsDpVFd:aO4rQtGRvNK3SfaheRlBcOS+9wlsDpVT

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3780	4362.tmp

Executes dropped EXE 1 IoCs

pid	Process
3780	4362.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3780	3872	2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe	21
PID 3872 wrote to memory of 3780	3872	2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe	21
PID 3872 wrote to memory of 3780	3872	2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe	21

C:\Users\Admin\AppData\Local\Temp\2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\4362.tmp
  "C:\Users\Admin\AppData\Local\Temp\4362.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-10_27163a32f3c0ff56b94443ded9695b0c_mafia.exe 1CE043265DCFB55D5900E2A9ADAE428E6C5A9676FA8673B04E31C1E9BA5B47FDA54B4F5CF06412159DE9CA185732D125AC6E8E8B3C1892ECA4DC039456C58B2D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3780

C:\Users\Admin\AppData\Local\Temp\4362.tmp

Filesize
28KB

MD5
b8eec4a6e9fd61bdb9cfc0a74bb5bf9d

SHA1
27d3e58899459b9f021af7285e1259c351b9358c

SHA256
bddd24e34290ffa9145296b588d233d702e17fa22a36e0400230d95438475676

SHA512
b5051fa5e7dde0796b5495ae96c479e1dbb718bb022a43d34680583e2f887501286020748e8dc513667695e72615cbb707d88b56f720b85e69fca7ea72a524d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4362.tmp

Filesize
51KB

MD5
8d1d020790f3ca6455987b996262ecc9

SHA1
142c2ba8f2d66333942a3f5fcb80c49f48314e0b

SHA256
cfa7c759211c83e3b67f4ce75b4d7b882c654d7444163dbf3d6937f452ff7a6c

SHA512
628c457fa94e7be3c7c2e372aed09b50a3ee99cc299235000c60f82953a87b0d1e8c32a827f00e8ae59d4163562744fd68a8aae305b54fd3fe90fb2ce0fed04d

Download Submit