089a919f8b3ad4bf469e7f39e0deee750d1ee54aad59667ca97ae6e20b5e7e48

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 10:31

Target

2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe
Size

412KB
MD5

a4fc9f4f2c045791f0804dc09fdb3f82
SHA1

876f4a148e7447e480573ae0927fa3138c32f621
SHA256

089a919f8b3ad4bf469e7f39e0deee750d1ee54aad59667ca97ae6e20b5e7e48
SHA512

1580328d5ac3d1872250486493b48fcb3968abddbbd5f0a87563978b5024ae8680184249ed37e933564b24311845335be16277d996dd47d19780f37b5f6de44f
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZn9QexE7Onev833GLqpoXsVP:U6PCrIc9kph5Xtx0xclqW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1752	C12D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1752	C12D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1752	5012	2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe	84
PID 5012 wrote to memory of 1752	5012	2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe	84
PID 5012 wrote to memory of 1752	5012	2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\C12D.tmp
  "C:\Users\Admin\AppData\Local\Temp\C12D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-29_a4fc9f4f2c045791f0804dc09fdb3f82_mafia.exe C8FA5BC0793E5302BF7E0F7E47653FCBAACB7D8CB43FF08E9D5CD4CD7CC8375D4EAE30572BA265FEA0FA455CDCE7AABC46625BAFF02508C931C9BA6351EA7032
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1752

C:\Users\Admin\AppData\Local\Temp\C12D.tmp

Filesize
412KB

MD5
7b043085e5ec0f660fed8f52c18ed3be

SHA1
bb2a6c9f5ff737c7b1f44046ab1bfc7128a61d80

SHA256
2a37bdd962a679b97956db84af05c7584f09dc1b5f4148602dd1d1a09635e15d

SHA512
6f0cf286a15b8463edbb7f9a5e597c891e83ba4dd53dd46d9c84f618817228876cc95854621d5b9e81ab1128385ab69d513a4199a6df32a7e1de8607de81abe6

Download Submit