5c747c6e46480cda518a4d74ada76991f5c721798d8e89797b99e226e82ed757

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 10:18

Target

2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe
Size

384KB
MD5

dc200f36e808a0736686330510eaa3fd
SHA1

166606b3c784122ea69b064529cc0c9816396534
SHA256

5c747c6e46480cda518a4d74ada76991f5c721798d8e89797b99e226e82ed757
SHA512

2cd60759991727af761ca216d58e673def440b718fa0e8751418c6a37abd87322ffe2ea11894daabd550f67048f78f354d38640765b6a4fd767d61299b33dc24
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHtLl3Q7ubCQQ8lFUgOojUCdjtEDN76dbFGdZ:Zm48gODxbzLh3TbCb88DGTdji56dbMZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5052	4892.tmp

Executes dropped EXE 1 IoCs

pid	Process
5052	4892.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5052	5028	2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe	88
PID 5028 wrote to memory of 5052	5028	2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe	88
PID 5028 wrote to memory of 5052	5028	2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\4892.tmp
  "C:\Users\Admin\AppData\Local\Temp\4892.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-19_dc200f36e808a0736686330510eaa3fd_mafia.exe 01252E541E4FB7E5BF08755EDBFDC446A9CF70CD8D739C919BFD046D29FB813AB8DD3BE682558E3A20C98AB7572C14E693EF8A47F24B49C07FDD38ACC852ECC1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5052

C:\Users\Admin\AppData\Local\Temp\4892.tmp

Filesize
384KB

MD5
042f87f8e7511bf9ffc6a236c1acf039

SHA1
b0e8ba8aeb7b5165a738f16e336222376c7c0346

SHA256
a40852eb227e98acdfb8840700f9260baa09fb1c3e1bf966a329a12df3bf990d

SHA512
9fca15f6f749190662bd7ffd541fddf97265b91daa4fa720e3ef1776ba852fa41784c1f72bec7e9caf48f8dcfe76ad48bc175b260ee23438355b0762aec699ec

Download Submit