eb6363fc27c3992e0546ac96956cfc1b0dfdf1fea62c546c128e485c06ffe5b1

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 13:33

Target

2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe
Size

479KB
MD5

6fe43302cc21924157ec3b86ef661395
SHA1

adfbb4e88b7288e993d8af6f990d8fac832d71c6
SHA256

eb6363fc27c3992e0546ac96956cfc1b0dfdf1fea62c546c128e485c06ffe5b1
SHA512

85d19aaa945f59c027b23c50f841997ffbdbc7b8491561c4a210f9e104c4094b5086d80de9cf9985f4c48f95b586ca35cc3dfc14eb369b207080dff427389a70
SSDEEP

12288:bO4rfItL8HA+bXJgTT3h6DjueNdTUQ75UO:bO4rQtGAT3R2juqdTUQVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3424	DF25.tmp

Executes dropped EXE 1 IoCs

pid	Process
3424	DF25.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3424	4004	2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe	89
PID 4004 wrote to memory of 3424	4004	2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe	89
PID 4004 wrote to memory of 3424	4004	2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\DF25.tmp
  "C:\Users\Admin\AppData\Local\Temp\DF25.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-26_6fe43302cc21924157ec3b86ef661395_mafia.exe 1EA304AFFE919DEB993777CCBEFC75692371B1CDAA557AEB5CA174594A14E355F3DE9E4F352D2B5B5DA1A9FFA9877572693C6BBF1CA90C553F079ED32512309F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3424

C:\Users\Admin\AppData\Local\Temp\DF25.tmp

Filesize
479KB

MD5
f6a8a15e93df606491018f2dd983b285

SHA1
7b46a15f92847837b00224716369dba2bb7f2e7a

SHA256
ccc16a13162907a40f11719cfc1ebbba4b2d5827dd37b113bd6047348a75c6c2

SHA512
f8c509a9e97c8cf2cda1623bd671842f00b3834b7b3cb03bec72cb6efde34bb09f30b1f4558c4de67ab74eb4bb8bf842a4389cfcf0496f1db2a71dac7e4b797d

Download Submit