049dbffeb0d1b9ba89feb293c0faad7c53c1d85cfce404c40c8cf7936a2c7f10

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:16

Target

2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe
Size

468KB
MD5

b6dd784a976b94685e03d1a90206e40d
SHA1

019810ea2670be394a1b5a9fa224117bdd86f7c8
SHA256

049dbffeb0d1b9ba89feb293c0faad7c53c1d85cfce404c40c8cf7936a2c7f10
SHA512

be24f19663df59beef52b8f83ce3ee0fc4555e6b1c73aefb5121c720dc75367d23231dbf6500a83650b05a4c20abff5859adf44c7239f3ad924d5e6303eebdd5
SSDEEP

12288:qO4rfItL8HGBXmYfvHdlA8b3eTNazih7bWmeEVGL:qO4rQtGGBX9f/d1b3epaWhumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4892	41AC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4892	41AC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4892	536	2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe	85
PID 536 wrote to memory of 4892	536	2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe	85
PID 536 wrote to memory of 4892	536	2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\41AC.tmp
  "C:\Users\Admin\AppData\Local\Temp\41AC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-18_b6dd784a976b94685e03d1a90206e40d_mafia.exe CAE3CAD42DC9B003C9F4DA892D63E0F39F264C4B4819FD050C828C81B539980DC4632CF73A9F4EF7D8C73426579F6349097FB96177A03F553449F1C5E1E018AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4892

C:\Users\Admin\AppData\Local\Temp\41AC.tmp

Filesize
468KB

MD5
e21fe1f3ed3fab2d48be89409540389c

SHA1
b37a8c050cf9d29cc616c9d00f535b40f1c4bd5f

SHA256
944f33f2aa5945bff82fa480e042845b2c60ff10292e0e3f7c97de0cbec2f7c2

SHA512
e95300ff34748f614b5c77cfdf935d5fa1631c7f131b139cad792bdcbe009d2881bf5f3c89a0ee4c8a44e72af2040429bfbd102785fdb81b7942788430a43e32

Download Submit