0f25952722969209643c50132835bc2a380dc8cf40684f4f9558ac21de81131d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 05:56

Target

2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe
Size

414KB
MD5

2d0daa49ecdcd06078f5d26be59c85d3
SHA1

2102fcd0aad49bf1b4fc2870b9c6e3c65b5a3b3f
SHA256

0f25952722969209643c50132835bc2a380dc8cf40684f4f9558ac21de81131d
SHA512

6f957f3e761dd40384b36c2af786aaa9f40603aa7c6a149f9c9aa829274de5e8e4f4d10eb529c3ea4141da553bb3466cfb1c2ad468812990aaecd7ac9b70df01
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYZnVwOcaYuvbSj7CJxAEr3hclHX06oml:Wq4w/ekieZgU6kVwaBmjuJxAy3hGuml

Score

7^/10

Deletes itself 1 IoCs

pid	Process
872	4239.tmp

Executes dropped EXE 1 IoCs

pid	Process
872	4239.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 872	832	2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe	21
PID 832 wrote to memory of 872	832	2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe	21
PID 832 wrote to memory of 872	832	2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe	21

C:\Users\Admin\AppData\Local\Temp\2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\4239.tmp
  "C:\Users\Admin\AppData\Local\Temp\4239.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_2d0daa49ecdcd06078f5d26be59c85d3_mafia.exe 489A8431B083457700AD109AFBAA949C3A6AD783777FC73DCEBB0DEB57A588B3A8BB9A844AEABC122DC5D5797266CC88F7D9286E5A9BA5134B8F4A2D78056943
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:872

C:\Users\Admin\AppData\Local\Temp\4239.tmp

Filesize
92KB

MD5
e834545be73254c8db0fd3787c810427

SHA1
3a4862db7caf1d3fb85eed534b99584b906165ba

SHA256
ee52e1896adf73f739a0dfc4b940dc5e765a3da236ba28e6c29cc6252379bf85

SHA512
f7b1a2f8c322b0224d8b9fedb69352569942165f503b42cd40d697347b1aed4f6a8d6da92fcf19f360cc5ebcd34f4346a8e567b64bf66de0e507a8903ffbb2ec

Download Submit