3f7bf6c0ad5dd212b804b05dd6da31f67e38b37965cf61aeb9bdccb012737faa

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:04

Target

2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe
Size

412KB
MD5

90938dc98f206c491a2d10ef769d3ed3
SHA1

6f65cf9a3e8cea487294423fa161631c4ca6cca0
SHA256

3f7bf6c0ad5dd212b804b05dd6da31f67e38b37965cf61aeb9bdccb012737faa
SHA512

367172b9e77b4463dbffcb86feb24775bf0506e65ae3ad26e9f8a71fc5465de9684bf62f3aecedbdeb390ce363d2964f5cbdae0a2664e0fc7c1045c77cb15452
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnqn6wa3bakX8SV47lCPf20tIlJLgE4+UMgP:U6PCrIc9kph50EeEXCCPfm54+6

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4792	4834.tmp

Executes dropped EXE 1 IoCs

pid	Process
4792	4834.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4792	2464	2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe	87
PID 2464 wrote to memory of 4792	2464	2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe	87
PID 2464 wrote to memory of 4792	2464	2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\4834.tmp
  "C:\Users\Admin\AppData\Local\Temp\4834.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe C44D2054EDE5567A54B362C18BDD3EAB33D33DB522C30F79E830A476CBF34BB7296DAAB100A2D6D8BF96E3BFC099856D1F7798FE8BE5AA716D9057985499F7FE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4792

C:\Users\Admin\AppData\Local\Temp\4834.tmp

Filesize
412KB

MD5
29323228ab36a533a74155756904f467

SHA1
a01325aca2b222eee2a15f36cac30ccf632c4177

SHA256
7953993bd772bfae8737c97361310a5ad69c388daada1335b0994dd3cb477faf

SHA512
45c8d89b95dac671ec020fd73670a1fa5ee060401ed7f648ce1714787687ec1d34a30b4800de723090e332029829d5b0cff07dd5b7781969d9ec81ef67502bd4

Download Submit