1ff23d9a5f0868ecd4ad379dcdd1cbe5c79e29cda1b47932462f4ee2577ed9e9

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 06:08

Target

2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe
Size

486KB
MD5

f1ab05e52247c0916bd6729bf1c15f63
SHA1

a420890b47c658379fa76a5eb4dcd917de9952ca
SHA256

1ff23d9a5f0868ecd4ad379dcdd1cbe5c79e29cda1b47932462f4ee2577ed9e9
SHA512

98e06b7f8d3b687551bb1452d0867c0551fc4e3a1431e60bdfa2619dbe18d0ef65376599131c5c990319e8c2675adc888b0c7ca52b60a1ab272e1170bcf69716
SSDEEP

12288:3O4rfItL8HP+bAvH8zfe2ve89YX7rKxUYXhW:3O4rQtGPuAvUGye13KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1744	49AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1744	49AB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1744	2880	2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe	20
PID 2880 wrote to memory of 1744	2880	2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe	20
PID 2880 wrote to memory of 1744	2880	2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe	20

C:\Users\Admin\AppData\Local\Temp\2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\49AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\49AB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_f1ab05e52247c0916bd6729bf1c15f63_mafia.exe 694E61EF771B18ACE715E83A32B2D69C66D84BB68D9CDC94535E09F76ACDF3843EA1B8898CADA20EF18C7649A4CCEC7871D5B8ECA6662D209860E3D5B1BA505A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1744

C:\Users\Admin\AppData\Local\Temp\49AB.tmp

Filesize
486KB

MD5
6c0ecfde5a7aa8829301869d6986d279

SHA1
af25f8f16146d57362d93290f8958424c43eb783

SHA256
292b6b963179e9424cb4c2001cecdbc6e3a85158061b7132dc0d70f7b5880e87

SHA512
97af13183c5f22c936a55965a21f71ef9f4634a6928a897e994ab4334fce64cc23483356c0ecc773e4167bf30259477630ca3d9d0f9ef4d6790f482c24e05140

Download Submit