793e9823393a8e5561823d5ea30c9cebea8f70a33d97c0d8296e465f4a2196b8

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 14:05

Target

2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe
Size

428KB
MD5

edcf6b170d10ed821f433e73ee545395
SHA1

f156925a93e6781a611927ea2b6086b84a5e24b4
SHA256

793e9823393a8e5561823d5ea30c9cebea8f70a33d97c0d8296e465f4a2196b8
SHA512

483216a2bc41bc4fb49c507ac4078c51067c58119ed02b2561cbe7659422263fd1d9462f791b7cefeadcc32f384eac922cb71cad5dd1656fc433fec59c398bfa
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFSqr/ESI2eFcauQITNh52ys3PNOyqbZD5eUVYqHR:gZLolhNVyEtMst+auZ/EfNmD5e5qHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2132	6FA2.tmp

Executes dropped EXE 1 IoCs

pid	Process
2132	6FA2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2132	1784	2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe	87
PID 1784 wrote to memory of 2132	1784	2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe	87
PID 1784 wrote to memory of 2132	1784	2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\6FA2.tmp
  "C:\Users\Admin\AppData\Local\Temp\6FA2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-24_edcf6b170d10ed821f433e73ee545395_mafia.exe DE7FE8EE15059B8543B93097C53FD667C289001A34B64A0B110FB64DB9FFEC1F098B1392496DEC15CEFA05FD81F5A0F642E249CD1D222A1FDA4F7FD0ECAC97EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2132

C:\Users\Admin\AppData\Local\Temp\6FA2.tmp

Filesize
428KB

MD5
44fd19e73ce545993bfc208552252406

SHA1
2c910f182d70195010d805afa05f4f9796dc1379

SHA256
66e0f9aa95f3044e26f68cd7511fa99362db00c71f894cf5da630f68d47a90d0

SHA512
8fe94d4caa8ed4e0c08bd254a4b7d9bbfbaee7fdf19ec19651d8cf7cd645780ee145b4956ca94bd81160d0242378da51c343dbc20e664c3c215543b87f0e74f0

Download Submit