6724bd401b601688d71ea09ccbbd488bd30ac583a76793b66897aeb4292034b0

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 21:34

Target

2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe
Size

444KB
MD5

93c9089e1549dcc655a32f2af0d0be1d
SHA1

4976cfcd9123864b6157cb8661b385231b721c92
SHA256

6724bd401b601688d71ea09ccbbd488bd30ac583a76793b66897aeb4292034b0
SHA512

f2299df5469d32726043ccbadc23d71c27aafe3f5bc1d36328bc24e4c807cbba639e48fe16f0e185fde8fbfdd0a61f51ab6b7db20d89531697298b8af40fb46a
SSDEEP

12288:Nb4bZudi79L38Pgb9mzIejWAi8IfxGGedU44A:Nb4bcdkL3h0zZmve2

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4060	4779.tmp

Executes dropped EXE 1 IoCs

pid	Process
4060	4779.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4060	2448	2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe	84
PID 2448 wrote to memory of 4060	2448	2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe	84
PID 2448 wrote to memory of 4060	2448	2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\4779.tmp
  "C:\Users\Admin\AppData\Local\Temp\4779.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-27_93c9089e1549dcc655a32f2af0d0be1d_mafia.exe A02A8BE340969FDE70E1E53B91E3BF0ACA7CCB76EA831BA0C1BBBCB102EB55F2205C2C36A5B3B3A5505D48F55E6C193B66E9FD114FA68B3CD94F49F32C648E4B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4060

C:\Users\Admin\AppData\Local\Temp\4779.tmp

Filesize
444KB

MD5
1f8bb65f7fb0672e757c26d9f228d395

SHA1
5aceb18d947c32c73c05c0bfa2db4e3c59743ccd

SHA256
ec5848ddf170a2f54511b8d9ef9eaa80aded59bbe5c8200c820c2ef6ed378744

SHA512
3def857017c83d2ae45f4563529b8288517b53040f31cde7023c38075da8c7bda727f67d9e4c4a4a5e36e7787d3e1c7a2fc4db4b93829711f62990009d9fe2bd

Download Submit