95c84f28dd60335a8d924687808f9e8f648a4cc213321b983e055c0569c5aa7f

Analysis

max time kernel
136s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:08

Target

2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe
Size

486KB
MD5

9bf92222693d0de1a16c4b8aae1bdf8a
SHA1

e3da6aa3d99cbba5dc8f18834f0f61bf5dae60b5
SHA256

95c84f28dd60335a8d924687808f9e8f648a4cc213321b983e055c0569c5aa7f
SHA512

49f40008295623ecafb3a017d085c1a4fed080927f94319c14f03083d5df3029bbb95b0a31e128d408dd81ccde8890ce119d0add055dff1af326123335b62640
SSDEEP

12288:3O4rfItL8HPabuo2dLzbkuxRjY+cCmRN3b7rKxUYXhW:3O4rQtGPpdrhLjYDCm73KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3660	B381.tmp

Executes dropped EXE 1 IoCs

pid	Process
3660	B381.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3660	3092	2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe	89
PID 3092 wrote to memory of 3660	3092	2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe	89
PID 3092 wrote to memory of 3660	3092	2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\B381.tmp
  "C:\Users\Admin\AppData\Local\Temp\B381.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-18_9bf92222693d0de1a16c4b8aae1bdf8a_mafia.exe A28504E126FC77C8F1231E878DA2FFF323D76E59DE7DFBCAE1A57CFC4C33B6F96448406D770650A27AE7FD182805C3DDCACA08C44E4E544BB498295EA08E8E09
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3660

C:\Users\Admin\AppData\Local\Temp\B381.tmp

Filesize
486KB

MD5
61802005bd41cbb05d5995429a6c99f0

SHA1
548ccb51f692fc05242762da767153b03a311eef

SHA256
3c0d5cde43929ec6dfdd36899a4ea9c3a844c498b51151473827146d1ae8195a

SHA512
6f1d3c31f773da6ae0573b13d3f030a46b2e1686760c68dfe192d604942e20e0c6c6963f926e6ec4b4abeb8719c954637c6be6a60cc9200496993bbbf8c6c823

Download Submit