bafca1616dac9781923fd76db20f50e51be837ab277d3140aa063a747655731d

Analysis

max time kernel
110s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 06:02

Target

2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe
Size

433KB
MD5

8f894c14a2c1c0a3b410919640bf3930
SHA1

dce3d32dc9b89e5ab003c68196dc5aa2ae3e511c
SHA256

bafca1616dac9781923fd76db20f50e51be837ab277d3140aa063a747655731d
SHA512

9503a5f4b1e98b8bbd3b8716c19519ba4dec19878602ca76eaf4046f2dbbe567e875f43bff99a4c23dd0ae85edb325b8ea6c29bc685b7f6f92381eb9642be204
SSDEEP

12288:Ci4g+yU+0pAiv+qfZxeoU+vjOprGXUupIWI0znNBYa79iVzbn:Ci4gXn0pD+Ax/7jmrGXdFlnNBYgU3

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2988	3E03.tmp

Executes dropped EXE 1 IoCs

pid	Process
2988	3E03.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2988	2180	2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe	20
PID 2180 wrote to memory of 2988	2180	2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe	20
PID 2180 wrote to memory of 2988	2180	2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe	20

C:\Users\Admin\AppData\Local\Temp\2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\3E03.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E03.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_8f894c14a2c1c0a3b410919640bf3930_mafia.exe 2D98A3E2B8770B7D5955A5A0F06C779737C8425007383A33A0921E13CD29EB6743182888F9C4C4BF0E96EC4620C546609EB32F2F783650E4C4277AB0AA2B217B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2988