770b71dac436a897c4027f0e4015a9b71d65eb753589234e0db7bac7c4a4ef7a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 11:43

Target

2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe
Size

486KB
MD5

ac9452366a459207d34c8c2b9728a871
SHA1

09a7d2f0dd1da9f329731ac1aa432828259566d1
SHA256

770b71dac436a897c4027f0e4015a9b71d65eb753589234e0db7bac7c4a4ef7a
SHA512

4ac787a28aa0f8dcf0f68d4afbf5bb598e9419314e4acb45438ef098c841dba8346debfb8364d5d3effdd7852354806f4006e04332ff80d8366c9a4360952132
SSDEEP

12288:3O4rfItL8HPncf5JAzId7CkwZEom77rKxUYXhW:3O4rQtGPcf5+zI5OZEH73KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4520	5266.tmp

Executes dropped EXE 1 IoCs

pid	Process
4520	5266.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4520	4244	2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe	17
PID 4244 wrote to memory of 4520	4244	2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe	17
PID 4244 wrote to memory of 4520	4244	2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe	17

C:\Users\Admin\AppData\Local\Temp\2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\5266.tmp
  "C:\Users\Admin\AppData\Local\Temp\5266.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-18_ac9452366a459207d34c8c2b9728a871_mafia.exe 571F072BE470808B079074766B67DBB5392A611BD1D7E3202616029CA493DACD88B8A6A040F9C80CDAE452FD982D6BA06085EAE9D1392185CDB80EBDA1B85B4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4520

C:\Users\Admin\AppData\Local\Temp\5266.tmp

Filesize
8KB

MD5
3129a59ea7e6a508d95c58586e2ac389

SHA1
e17f1bdf612a4cca89f43c61459c8b9742802500

SHA256
a39757c120f8c0e8e68eab407067921ec3ca5ed6163414cfbdaf59d52bfc395f

SHA512
d10a32257acace9b7b797342108144a7e7b4d6ad29f4c4ba9345573b401538c0761697dc8d48e375444198870d2b63a13f7f1df434246d1c613c9cb4a2128cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\5266.tmp

Filesize
47KB

MD5
98d19091bfd87155f132679a75e88a8d

SHA1
f39058e8fa2b3178f2cbc09ceae7332bd5c5a206

SHA256
d6ed77ca22579428c3fb103e7ee2bb1f1951a5fff67aa9da791d6a4431edb1bf

SHA512
738ae7b53f94b4a4f734801529b718d0c23d14edc331f614ba0e2575d49fcb6ab7b59bfd51e1d4e3a785fd8735c35e80630a90cc471070617e648fd0dc29e4cf

Download Submit