16948d46dbd9b29820ac769081196638aa50e018eef3d40156882df9184c8b9a

Analysis

max time kernel
135s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 22:32

Target

2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe
Size

476KB
MD5

2337df2732d4f6cb004af3ba98c95322
SHA1

7c92cb1b4ee1c33ebd51748fd061499ccbf81acb
SHA256

16948d46dbd9b29820ac769081196638aa50e018eef3d40156882df9184c8b9a
SHA512

de4a84d0d208cb35fc002212036f04c48d7bab808c30605f3eea5b61e87e4a43af42e6c073089d5fef2cdafdcda18671e1267b161f26b8334abe135a4a792464
SSDEEP

12288:aO4rfItL8HR8aGqirPteFdQLBFy+WVJ0yBOgtP7K9wlsDpVFd:aO4rQtGR8aGqirPUGeT3+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1428	D987.tmp

Executes dropped EXE 1 IoCs

pid	Process
1428	D987.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1428	4484	2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe	89
PID 4484 wrote to memory of 1428	4484	2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe	89
PID 4484 wrote to memory of 1428	4484	2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\D987.tmp
  "C:\Users\Admin\AppData\Local\Temp\D987.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-18_2337df2732d4f6cb004af3ba98c95322_mafia.exe EF597F167415C6B228F392422D814CAED78AEE9F55944CC6A86093C7D899D142BCD57347CCEE1297C8D72E4FA2F1BF72EBD6855A1BC0EDDAD54CCEC4CA6D3F16
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1428

C:\Users\Admin\AppData\Local\Temp\D987.tmp

Filesize
476KB

MD5
9b59c72a651fa95dbf34f3752cf9d512

SHA1
c57a3bd8a17bcfc0adcdb5d59b66ecbac456c36e

SHA256
d9cffa028b38c2aba61b83f08f7c62ff35e7bcd8a25ddf6c7691db03c6d7b41e

SHA512
4044ba25a52b9a9a772c70963e9f31b1a47b668208263204416a230ab72aeda7a2e4fcf986a9ee387134664db813458c5241e7b3f6207d551dd5579fab51ce34

Download Submit