730ffe6fa09bcbde2cbf1ba8ef114df92ccb9a1534d00415ee68e7edde3f5d74

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 19:34

Target

2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe
Size

476KB
MD5

5e51777be56424c1fc4380f5745bf4ac
SHA1

5db16c28c5cef810f46f38c497dc39ba77c66b8c
SHA256

730ffe6fa09bcbde2cbf1ba8ef114df92ccb9a1534d00415ee68e7edde3f5d74
SHA512

1e8887cfce37a935dbbcf1d42967689811589c610c7a14300fafebf5e3b8cf5be466b9a97ed357f8d800661473bffb83cc8e83109e3658f941092aaa9ba604e0
SSDEEP

12288:aO4rfItL8HRnrJnL4vowjgrcdTv/b+WKcch7K9wlsDpVFd:aO4rQtGRVne5j3Tv6Zbh+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4748	53CD.tmp

Executes dropped EXE 1 IoCs

pid	Process
4748	53CD.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4748	1136	2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe	20
PID 1136 wrote to memory of 4748	1136	2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe	20
PID 1136 wrote to memory of 4748	1136	2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe	20

C:\Users\Admin\AppData\Local\Temp\2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\53CD.tmp
  "C:\Users\Admin\AppData\Local\Temp\53CD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-23_5e51777be56424c1fc4380f5745bf4ac_mafia.exe D8AB2ADE5ADEF02902DE72D6325489CE3CE447830FE2A6CEC32A0476E894F6558745D79116EF791D60749A5DF4C94D71082BC1C6C8B8AAFFCD6D1B73419B707B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4748

C:\Users\Admin\AppData\Local\Temp\53CD.tmp

Filesize
1KB

MD5
daee7251926b044b5ec3590f5dc3dc90

SHA1
e26356ff74c988388e374bc65a03d2bcff47c03f

SHA256
d850f417919240540d681554ab9edf8e20c702befe893a6042042aae8d1eb196

SHA512
902953f505286b53eb4db326ce25c283588208e396cc8b67736c0c5f54fa502d9ff08ea67e061edd712c469e330c440933e59b60b01e63a30212260efd9f3aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\53CD.tmp

Filesize
24KB

MD5
24348788451e459d0c718e9734056cd7

SHA1
1c52914ac4ab83f010a7eb9450bcf1403c14a822

SHA256
d30de56cd05d94fa6e97491b67c7aafbdb663fe3f1fe1355a12dd7480e2a69d1

SHA512
36b0c17cddba8d35caf2764e6a3bfad224c74cbdd43f84b700141f998fd0fd13dc3544ed628fe6d75832818c8083aa5206cd202a0daab45d9ed05f5d7d87b7be

Download Submit