38660680cd48edd0e2f03f064002c184c9c660f92f09c7d6c16afa83c56cd447

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 09:02

Target

2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe
Size

468KB
MD5

5335663d40b580db4f6e99e7fed390cb
SHA1

c0f99128b5963521746aebe3ebc577176ee3b871
SHA256

38660680cd48edd0e2f03f064002c184c9c660f92f09c7d6c16afa83c56cd447
SHA512

81f6a47a524b584ce2ecdd3def3bc73bb6aa6bffb96c9d654aea3d2e73920880a6c498c0496439439596ad0395761f602ed2be5d5abe18cf867ec4bfe57c1d33
SSDEEP

12288:qO4rfItL8HGE+018zhQsXDnS2Sw7uO8k0pRx2nc7bWmeEVGL:qO4rQtGGC1AQsTrSwlcOncumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4504	4A47.tmp

Executes dropped EXE 1 IoCs

pid	Process
4504	4A47.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 4504	3732	2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe	84
PID 3732 wrote to memory of 4504	3732	2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe	84
PID 3732 wrote to memory of 4504	3732	2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\4A47.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A47.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-01_5335663d40b580db4f6e99e7fed390cb_mafia.exe A02A180B4EF348E8F330D4794D1A990F69410A42E48B1B973318EAC1DAD588465B32F7C5F0651D3A02A9411D610B12F1273FAE34ABE4DC256A0B63A6BA1D8688
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4504

C:\Users\Admin\AppData\Local\Temp\4A47.tmp

Filesize
468KB

MD5
14f34cb6b2814d0da50dfa653b87f473

SHA1
2fc23cf88e53fede213e82cb8b18bec4c0eb0d76

SHA256
eeee54b19b6becc2234cc15c2413cd333060e26b81acc50ee6e7257eafe27089

SHA512
3a77fea06025ee6e9205bdfc051a6fdca65ddcd4fcee33e2c1238391cd3c27d79ade3b097c3c70c7d234fe1a1f217cc8d9a9724ab577e889f055103146ec4bdc

Download Submit