400421d508d6c40599f004ac1db0cf8d3fd9d47c42a0843bbbb27dfbf4bce7d4

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 08:41

Target

2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe
Size

428KB
MD5

0d312ef3c1e069a9ad875f89d63037e9
SHA1

71c2f0dd222063c7c530c5341dc5b1baa93bda44
SHA256

400421d508d6c40599f004ac1db0cf8d3fd9d47c42a0843bbbb27dfbf4bce7d4
SHA512

bfa83023113aaec23ec39011037bf8732291f5704bdd84ec414f5ac72022ccc97d7d5292a3751fe3ebd4d1554e727630b4b6303b1b220a1d3db46c953a74f707
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFgsmXSkLLCnyN+j1pXnrY0EqHR:gZLolhNVyEpXfvHmXk0EqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2052	FF01.tmp

Executes dropped EXE 1 IoCs

pid	Process
2052	FF01.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2052	1416	2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe	89
PID 1416 wrote to memory of 2052	1416	2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe	89
PID 1416 wrote to memory of 2052	1416	2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\FF01.tmp
  "C:\Users\Admin\AppData\Local\Temp\FF01.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-26_0d312ef3c1e069a9ad875f89d63037e9_mafia.exe 00CA3487A67950CD68ED5FB68F544CC5DE17A95A7522F52FB51E17A93E607017FCB62800B1BE33A1F8E8F7D2B94C7C5AF3926D3279B1A41ECDA0620EDA6038E3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2052

C:\Users\Admin\AppData\Local\Temp\FF01.tmp

Filesize
428KB

MD5
147e8fa74665aba07d87dd00eaefb9c6

SHA1
3dc758b0dc649a1cb9477d6b7bf6a6c83d96c698

SHA256
b2b317ba962cadb560c56f5b6436392ab980d9f6c536c35450196460b5be46ab

SHA512
e756eb8be2e7cb822f505280f2abeedc66b8d019b1b871cd4a806e361cc4ee338a49dfa6c098ff36d1aec3150e037ae7a705810bd3ab8e9965f543bb42e3ea64

Download Submit