fabb04d6c41b9e94836ab4499a257a681155b87d370418284aff6dd6e04e9e2c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 05:41

Target

2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe
Size

486KB
MD5

e3dc229d3421e7f0d997782cb402c108
SHA1

e95877b3bc86dedcdc4b25a338b2655fd32c1124
SHA256

fabb04d6c41b9e94836ab4499a257a681155b87d370418284aff6dd6e04e9e2c
SHA512

b5452ab2db4845fa76b1f5893acf755dd948f27a504aea3f04d56af727e2e58fd35d747325d1b4a85b3279e8a1faaca9a4dc5709943368efce056245a57fdcbf
SSDEEP

12288:3O4rfItL8HPepPR0dB7jWg5szTV9xPrl17rKxUYXhW:3O4rQtGPkZ07f5svV9x513KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4736	3F2C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4736	3F2C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4736	3224	2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe	86
PID 3224 wrote to memory of 4736	3224	2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe	86
PID 3224 wrote to memory of 4736	3224	2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\3F2C.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F2C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-24_e3dc229d3421e7f0d997782cb402c108_mafia.exe C78547454B0C39C89F41D414BC5DECE3CEEBB99AE42EFDB048B4ED9734F770EC29BB3ACD885F4B49F4FE9BC0DD454C5B8BB77BC9A81015EF56C199EAF9B477D6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4736

C:\Users\Admin\AppData\Local\Temp\3F2C.tmp

Filesize
486KB

MD5
0c53548731a81c9bc99766f4402055f6

SHA1
f1765138b141a09789d230cff1f78061744382b2

SHA256
fbc828d3158952564a7a077f49eee4c09b3cafed8b9298c21468a7bf7ae1980b

SHA512
23284f6f9fd66d084666478eb0afe489e23e46d6d1bef947903a82e37ba2603462a5c0cb8f03f420fba2194d2795655c4134d64e558bcf2c0d0eb92fcf4d872a

Download Submit