1ccd73fb1848e6518767482764d59604648e6d5e6909ea5eeb96b2c5c1018601

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 11:27

Target

2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe
Size

486KB
MD5

24ed5f23089d7c0420c8592a48a2d867
SHA1

4e6547050fe809e7e8a24491734bcfbf55e6ad72
SHA256

1ccd73fb1848e6518767482764d59604648e6d5e6909ea5eeb96b2c5c1018601
SHA512

52ca576b1792cee1f96b3a648829f91ac6bc547336a07f335a71f4e433370c4b753ecd46584053d6c5c7f81aa122565039658e6bac2fcdb013b466fb4cc3a6c5
SSDEEP

12288:3O4rfItL8HPLHd98JrdHnzFN11Ib5zk8t7rKxUYXhW:3O4rQtGPR98/HpP1I1zk8t3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
888	9078.tmp

Executes dropped EXE 1 IoCs

pid	Process
888	9078.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 888	5052	2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe	87
PID 5052 wrote to memory of 888	5052	2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe	87
PID 5052 wrote to memory of 888	5052	2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\9078.tmp
  "C:\Users\Admin\AppData\Local\Temp\9078.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-29_24ed5f23089d7c0420c8592a48a2d867_mafia.exe 4DB4FF6CD8146A24A5146238E9C11A2B5C7EB6DED67CCF3DAC3367C72AAC10A8CB9CEFBBD3F89A754E15C429DDF86A265F47B60B528B4E8154567D3892CEB735
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:888

C:\Users\Admin\AppData\Local\Temp\9078.tmp

Filesize
486KB

MD5
e3b2f1be980df63cb0248afef4f91f53

SHA1
3313a57df4a6ea94a02de612652125c13feb8e95

SHA256
1968c24c5686ad2dc3350e03a1018facf94ad91112007addf7389ca2e5415308

SHA512
408936d8bc77d5ef7f761ee834e511be8d9234c707147831b4d29724013d4b242d219ae7223ec6c69f73b3c6b53d20ad09a078227821d5e49497616ce70eacbc

Download Submit