0b1b5ccd3274ed0058b5f133a576c62dad353d2da9dc8fa6420148421a8b1c76

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 12:25

Target

2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe
Size

384KB
MD5

3bc480087dcd64e8bfab7cc8cd05beaf
SHA1

8ee89cd1b3d35d62e1eacb49c7c7f4536e64c57d
SHA256

0b1b5ccd3274ed0058b5f133a576c62dad353d2da9dc8fa6420148421a8b1c76
SHA512

06d8efc359f22a1c53d02f793beaa2d7601651bfd3d8be2fde80ea28ade65b57e321c260a17ae64db9b44ea3ef87dce7701f021c63174251bc699ee7e5fe5def
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH8jGAvvjZf6a+frii0OS1V4APcVBAPO8TZ:Zm48gODxbz2jl6a9iRS1V4AP4APOmZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3048	3894.tmp

Executes dropped EXE 1 IoCs

pid	Process
3048	3894.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3048	2876	2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe	87
PID 2876 wrote to memory of 3048	2876	2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe	87
PID 2876 wrote to memory of 3048	2876	2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\3894.tmp
  "C:\Users\Admin\AppData\Local\Temp\3894.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-24_3bc480087dcd64e8bfab7cc8cd05beaf_mafia.exe CEDC156E740D574CD09004755D5167BEEEEF08B27A668BE0AF2416AE83E36FC801C15EF0A35A6F16E55DCCBC0EFECD0365B35BE7E1ED8F476FD0AF82AD053333
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3048

C:\Users\Admin\AppData\Local\Temp\3894.tmp

Filesize
384KB

MD5
020c620609479bd923399b50183e9b99

SHA1
6d29e972691ad6e1a8a915858a0e187ee941f745

SHA256
b341ab70bc791220d1e1856d14824b1b3f3793b2c0d37db3f0330283271b9f13

SHA512
d47e61ebcc0ba29f1c9551e27c8dfe91c7b8966a349ed4e41c347ca347706a5fe331016e566111bfab360d826e149d3a54dad83f0b696b8347a7c8bcf2025098

Download Submit