0eda76d3cc8557ed01ccdddf808f1aa1068cb346542a9d2e0dab30435341eb8a

Analysis

max time kernel
112s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 06:05

Target

2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe
Size

486KB
MD5

c43a6878cf8018e68945e00f7f663fb3
SHA1

611cf4e8202a5ff43d3e5ff04c874cb0dd8229fa
SHA256

0eda76d3cc8557ed01ccdddf808f1aa1068cb346542a9d2e0dab30435341eb8a
SHA512

2807dbfefe1ebd3980bddb36918a887b57777d16b10747033c9b1b9b7d04cfec24c08ca8a086325c171774fa3fb7ceb02eb876cbdc8333672b29a754830e65a1
SSDEEP

12288:3O4rfItL8HPVk8dp+YYGRjie7rKxUYXhW:3O4rQtGPVkJYYGRme3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2016	3CAB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2016	3CAB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2016	4380	2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe	20
PID 4380 wrote to memory of 2016	4380	2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe	20
PID 4380 wrote to memory of 2016	4380	2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe	20

C:\Users\Admin\AppData\Local\Temp\2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\3CAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CAB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_c43a6878cf8018e68945e00f7f663fb3_mafia.exe 6EEBB3CF9E5E2B9C3DB648E006EF4F7FAC8FA5FED0882475766AE896A1880A698912E7F65758C51CC7FBBE7736476FE1F4F25646644D353CD095D7C54A9FA149
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2016

C:\Users\Admin\AppData\Local\Temp\3CAB.tmp

Filesize
486KB

MD5
3a42d39a9ca13cf83a8993ddbba71c34

SHA1
eedd740824fdbc1f52e3b6ed2f5481207788a192

SHA256
95494060efbd92941bda8301fed6a9084443b8ce51ca1ea6ead07cf7f9db7944

SHA512
b0af6c872d4365eb983a16130008efd2a6a57edfeae5439b605116ad32a40808e379c0d08d0eeef58422a132390c23110b8a8cfff3a4684c8fb4e99d45ac18cf

Download Submit