3bf8708cce46d37458aab1fbf830ee8ff92156bffc3a17bf87e081d08fbe592d

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 06:02

Target

2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe
Size

428KB
MD5

a6c93dcb2e74948d2076b8aa02c0c11b
SHA1

5c7a68c37a91719e20825d18d8bfb0b1b1871926
SHA256

3bf8708cce46d37458aab1fbf830ee8ff92156bffc3a17bf87e081d08fbe592d
SHA512

83e80a7152308b92023a8df1a64f7786c607fceda31165c024a8009fcc864ee2b2cd638540955f21ac9f22dadfce4b0db1a5f96c80f3d518872dc47b73e4defc
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFvANrBWE4Hwe7AHHHon5bcRFxyWqACH3JJqHR:gZLolhNVyEyAlBb4HwHnc5QJOH3JJqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4456	4779.tmp

Executes dropped EXE 1 IoCs

pid	Process
4456	4779.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4456	3988	2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe	86
PID 3988 wrote to memory of 4456	3988	2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe	86
PID 3988 wrote to memory of 4456	3988	2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\4779.tmp
  "C:\Users\Admin\AppData\Local\Temp\4779.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe 31E49979F9DDCEA2D1A82035F5A185D3CF0C214F0F5CBD6AD178942F560803AB1463A7CB0582C690CF03BEEA92C24BD519B9FD2854C571A79105BF6C39A988DA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4456

C:\Users\Admin\AppData\Local\Temp\4779.tmp

Filesize
428KB

MD5
3874f0bbdb0fcd2b19e0d9172f7cde1f

SHA1
0a6ada67f002209d9aa9358d1202959451ac00b4

SHA256
72287a4f2863404496b8ff705e2581708f01038a18d918386c54c6d1ac2e8a0a

SHA512
516ff5044a20159401be684ce6d958216b6eda1fc5a3b9e112cb345ee82b070e57bbcf2d62a66f0926cd0ccf5f2dee034dcc9a9381df09ad4ce4b54fc6ce631a

Download Submit