d30c0a95f64a1de67925f4ccbc3530fdccc4e4d1ee8c5ef07c7cc0aa1ce80c3f

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 23:22

Target

2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe
Size

479KB
MD5

3c3e481331408c70f295131f6dcddd22
SHA1

47d35310f3c281cba7e6eb485fe4cacd709b8879
SHA256

d30c0a95f64a1de67925f4ccbc3530fdccc4e4d1ee8c5ef07c7cc0aa1ce80c3f
SHA512

19712168efcc0abbe2880d04777fa778ad6ef97c8eabd457bb483662264bb95ad107909ea19156392de30b0944f7c3ac652e878f87f4a136e279add047c6b7c3
SSDEEP

6144:b9EyS4oMxIkjxcWqHtg88HARRc9peT+/z55ITowlOr/iAbxGAzjjokjPZo/PiWuo:bO4rfItL8HAU6+bvyOb5JXR6im75UO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5056	4F58.tmp

Executes dropped EXE 1 IoCs

pid	Process
5056	4F58.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 5056	4036	2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe	86
PID 4036 wrote to memory of 5056	4036	2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe	86
PID 4036 wrote to memory of 5056	4036	2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\4F58.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F58.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-26_3c3e481331408c70f295131f6dcddd22_mafia.exe 11F1217D1A6F8C39E42B163269AC7DF189A7F2FD2B46A4D694AA30B39555CC8CF60AC3F546F9B63153C7ACF198FD1BB5E2F8071552EC83C4F80304B1D9FCE2CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5056

C:\Users\Admin\AppData\Local\Temp\4F58.tmp

Filesize
479KB

MD5
9110e7bfa8480a9490d716c8f512bbe2

SHA1
7f67b87305e96f4be067ac99701f0be9cb871765

SHA256
9c8d21fc1eb9381a58c7563b444a4bf2b66f0478e4e92357b526b385d715a5e9

SHA512
790300cb8effa2260b6c74df507189af20cdb3136c6c865704d4c4bc58aaa32e94c3bb25cb86158422e69774367ebda8e5aec7ecc8a28f5fef0da8e88557f46a

Download Submit