253d407140a866fb695afe609efd3d9d7e7006584b605f7599709b492a56884e

Analysis

max time kernel
90s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 02:39

Target

2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe
Size

486KB
MD5

f959adeb28597a664fe517824c6eb857
SHA1

6d037a0fae04f0b67d116e2215a7b777ad1342d2
SHA256

253d407140a866fb695afe609efd3d9d7e7006584b605f7599709b492a56884e
SHA512

068f6ea2a7fb79607647d1181d3464429010a38d50191d4eb1a323f4d4be75626f2a0970f41cb7dfc97911dd5d3e82989af283781250e51abc2dd03c500b4ac0
SSDEEP

12288:3O4rfItL8HPrrpLRAL3AsdKAbi21b+krr65VdHkq7rKxUYXhW:3O4rQtGPfZRAddKSdKkr65Vj3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3064	4D45.tmp

Executes dropped EXE 1 IoCs

pid	Process
3064	4D45.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 3064	932	2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe	85
PID 932 wrote to memory of 3064	932	2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe	85
PID 932 wrote to memory of 3064	932	2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\4D45.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D45.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_f959adeb28597a664fe517824c6eb857_mafia.exe EE73190007C61BF63B7F70539943626C9851EFD9FFE6730F0111201A7A724598A83D036689AE6B132347AC22F6B6E000235CDB1A9293092281B655132B1C56ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3064

C:\Users\Admin\AppData\Local\Temp\4D45.tmp

Filesize
486KB

MD5
3a64e70b2f7378f20921ebe4020f3dee

SHA1
2346f882c682e83c25ab5f6219157641364a8248

SHA256
27e45fb5556df4e71d640283b19987a4d17b27ec809cce2c3b0fb271cf5be4c7

SHA512
8706d7de372000f2809e7bbca5f30d38982a5798ffefc8242de0359f08eb6bc8c846da57f07d22d9c08a2de9378724a59ca5ee02a7009f7ed7c0132a08e8752f

Download Submit