1fcf98b383e51de4b0b13c3190f6622d8e1312762f8e3c5cf16bfcbf3a2aaeb8

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 15:32

Target

2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe
Size

479KB
MD5

904b18a765ac2d514eac2a068319ab73
SHA1

0b29e09a215ee1832cb50b7a36f5ae95dc138f1b
SHA256

1fcf98b383e51de4b0b13c3190f6622d8e1312762f8e3c5cf16bfcbf3a2aaeb8
SHA512

cf352d4eee2aeaa84a8be38826df4a5b449de416af4b4bd0e654540d1364e78ed83a1a7aa604dd6d427ebf6eba5a4a1bcfb6871c4dc3eccb15f9c39a393100fd
SSDEEP

12288:bO4rfItL8HANtWZRp3bfBB71h8LDf0mr+NN/gD75UO:bO4rQtGA2l3bflh8LDf0mrW/GVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3920	5AD2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3920	5AD2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3920	4524	2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe	85
PID 4524 wrote to memory of 3920	4524	2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe	85
PID 4524 wrote to memory of 3920	4524	2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\5AD2.tmp
  "C:\Users\Admin\AppData\Local\Temp\5AD2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-27_904b18a765ac2d514eac2a068319ab73_mafia.exe 481DA58A788F96185F235F8828242A5CEDBB9EE7517135B5BEF08CB275E3D0E4DC4B385D2DD190A35E111C3A92348CB6B85F4A9EF4FA6413BC3E6FC31C50607F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3920

C:\Users\Admin\AppData\Local\Temp\5AD2.tmp

Filesize
479KB

MD5
f6d8a6f97ce38204e586d47c59334e7e

SHA1
25d8ee2bda63aea83d9810b9e4e3fb7d9140ad17

SHA256
3cf9319ae18397ea91c6d90f7baea1c4b607005a50cccda5cc1dbab7cfec79a3

SHA512
3e9b33241ce279fec4b8a2a9abaadeab86d1fe9b9da507f64f2190fca1cb37a11b380ef68f87ab21e812c5b591cc14ee4f8c9c1530719baef4844a4ccf9daeec

Download Submit