efd4e1d2b1bff0c6c374971c073f692d526ed44e410f2fcf7de22536f716f820

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 23:43

Target

2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe
Size

486KB
MD5

51d1e2b451b575be9e51b88b394144d4
SHA1

0724f6ec23ecee550473ab9570a45f815e13ed2a
SHA256

efd4e1d2b1bff0c6c374971c073f692d526ed44e410f2fcf7de22536f716f820
SHA512

c35c202e646ef4d869388d21e6e8e1a50b506cb5ec2ceca1dbc2443705ac206260f5ea96bff42cd73d04934936a212ce3f0601c78dfc2cde4bf33b646b538b3c
SSDEEP

12288:3O4rfItL8HP0OVCS0/OSAZZJRFEJexjxsFsdS7rKxUYXhW:3O4rQtGPGSK2Z4iVsidS3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2596	FDA9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2596	FDA9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2596	1428	2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe	86
PID 1428 wrote to memory of 2596	1428	2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe	86
PID 1428 wrote to memory of 2596	1428	2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\FDA9.tmp
  "C:\Users\Admin\AppData\Local\Temp\FDA9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-26_51d1e2b451b575be9e51b88b394144d4_mafia.exe 12FB81EB916CB81D59D8C495D35AFA441F6316C060D2B20429F4F4B884E8E8E0D3A74B249B34342EC61F487C8A757B98752776D530DB12A18BB67473AE7E500C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2596

C:\Users\Admin\AppData\Local\Temp\FDA9.tmp

Filesize
486KB

MD5
3f2d13ecd1b0b243707e0af9b418165f

SHA1
9a62f96c6ce027cd93e976f434a8d9a63cdc8a41

SHA256
fa2317f24e5483f7c46c8f367c3eac5a3637c358afd44caa903e424ce14b2bcc

SHA512
96d10956ebddf7d52682c9bd323aea769f626427d900b40eb3063511f4af0be1b80552f2b4ff8b8ae6db66ab47378f97a546b9674a33336bf51b3f3af24fbdc3

Download Submit