db7cacb6feef2c3081bb100a5219f5ee6fa4f2b6efb50b6f1aa8ca56be1d4f29

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 06:04

Target

2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
Size

468KB
MD5

afde6aeff1188dbff7e22c65ae6aaedd
SHA1

fbaf017e89c02f388695e264f57100a8a7b11d2d
SHA256

db7cacb6feef2c3081bb100a5219f5ee6fa4f2b6efb50b6f1aa8ca56be1d4f29
SHA512

518650ddef88ec8997b3df286789f454cfc6fc2d458be019e9e9257b4d22bfd03b74ecd0929422ceaba29a3c884fd495d336ca98debdf874e6c781e904178b88
SSDEEP

12288:qO4rfItL8HGz4loXXkcRsq9yZdHuv8jgbovfL2U7bWmeEVGL:qO4rQtGGIvce2Xv0tpumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5020	8889.tmp

Executes dropped EXE 1 IoCs

pid	Process
5020	8889.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5020	5080	2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe	34
PID 5080 wrote to memory of 5020	5080	2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe	34
PID 5080 wrote to memory of 5020	5080	2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\8889.tmp
  "C:\Users\Admin\AppData\Local\Temp\8889.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe EA9F6276A5246C66BCAEC502535FF726C3DFC23BB126F45FC27285CC56D8287728FF2314D13607FCE887381B12B336559056277DBF8CCADA263BA5D8A88C7246
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5020

C:\Users\Admin\AppData\Local\Temp\8889.tmp

Filesize
57KB

MD5
86793f514c471694cc14e934c6fd25d4

SHA1
e877739b53993823877ebe982caa63e4fe961be1

SHA256
6f802e8b2be5ca2e8855b215b9d8318783476116c688603a84b25f1368e9b2f1

SHA512
79d8ab1f7c6db1bc0e536399b8065b15bda33b2e15a9e48e432d9828636024cefeb55fdd651e20a518b973d348d738aca3ac5484f0ae5a20703ffd01d43223e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8889.tmp

Filesize
5KB

MD5
07c73fd5a4812fa046556352b5b8f266

SHA1
4db3f5348c183d7cdd5828e4879689840bf26cef

SHA256
a718682a9e5d3ddbabbaa390b73f886c0579513507df45544fe266343db429c6

SHA512
a971ec9b8237a9d296ebc4784c22b1a19777eb0da86b3c1a0a2048f8aa56628b30c5a23594bea5b79a8081355db8ce036c99909b57591d97f99f774ddd2ef538

Download Submit