f10ca495db882eb74bc2d0de776e78c66c6704d36d0a376fa571c81e2c69b0b1

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 10:30

Target

2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe
Size

433KB
MD5

9d896c664ec2fdcf4281b8eb20cb626f
SHA1

6e24b54d942cda2dc11672107db9bba337d9adb5
SHA256

f10ca495db882eb74bc2d0de776e78c66c6704d36d0a376fa571c81e2c69b0b1
SHA512

37fbcd7022cc1dcb3f157686210b856d64099289e399ec9b90f03ad4d566fbe323ca79c733f29bd0bd9c8d7dbdd8bd95064a5b5f5d82310ebbb4608f60f89269
SSDEEP

6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvC/M1DROd0gSReyeWxc7mSAZnqaiER3J4n:Ci4g+yU+0pAiv+AkSd0tfysiEz4n

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1272	4537.tmp

Executes dropped EXE 1 IoCs

pid	Process
1272	4537.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1272	2488	2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe	86
PID 2488 wrote to memory of 1272	2488	2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe	86
PID 2488 wrote to memory of 1272	2488	2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\4537.tmp
  "C:\Users\Admin\AppData\Local\Temp\4537.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-28_9d896c664ec2fdcf4281b8eb20cb626f_mafia.exe F937069F807A95236AB917459E9B753815B0CAFAB2ADB27BC161B162AE1E1B20C1C4CAEF94628C8D7D895095C4A5DE38F62031EBA76157F907499E42F0C36352
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1272

C:\Users\Admin\AppData\Local\Temp\4537.tmp

Filesize
433KB

MD5
515b8e82c615feeea2d2a61f2b031802

SHA1
4ac9fb9e7e0b1d920a87e616fc5d925a5900da61

SHA256
0c77dfd410babb07bfec6fe78beeb7ffe9a757032c31a64b607c363ab30401d6

SHA512
d05ecb9ea24093816cc2bc70b493fa2a01718e716c0f127d9c84d6991c423f171563d1dd29256a1087c02e015324183b5776ece730dbcd45496871cbf02d09b1

Download Submit