5aaba7e27f2a36054abb640b985b6c2adccd3172de13677dad514b6953d5d6bd

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 02:27

Target

2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe
Size

443KB
MD5

438b7fde292380770a3491ad66dc2a0d
SHA1

b4afe03219114d6969544ddb2e01ff0a6649e95b
SHA256

5aaba7e27f2a36054abb640b985b6c2adccd3172de13677dad514b6953d5d6bd
SHA512

b42734987d7a92a10a277c5718d452427481a791823c8c58e34a9636f0491e4259395d37e1277a7315cc3e6141c0d2461604b0c031cc518d92bc51b86b4d80bf
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BY9L4yH+5jYahEOjld9zSd21GR49yYOQlMa:Wq4w/ekieZgU6sgN1mOjlmd23SQlMa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1136	4B90.tmp

Executes dropped EXE 1 IoCs

pid	Process
1136	4B90.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 1136	6016	2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe	86
PID 6016 wrote to memory of 1136	6016	2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe	86
PID 6016 wrote to memory of 1136	6016	2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\4B90.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B90.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_438b7fde292380770a3491ad66dc2a0d_mafia.exe 8F80D8323EF669EBB947DE7F27E7DA46261939B196E466B2B459765E5F9233715FF503E580613C83401A9D75ACE4C2E3F37F7008D6FE2D201484CBD1F40AA48E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1136

C:\Users\Admin\AppData\Local\Temp\4B90.tmp

Filesize
443KB

MD5
461a333f4161ebc300beba0fe0b28706

SHA1
86a2224d4d90254b95de5e4cbd34a2051c42db62

SHA256
60498bc5058a4c69d23b0362cbb8f724f1222c8e9a8ad16796d12e896c30144d

SHA512
6124fd2cb2da7a7ed6c326863f1a053b7ad0549fd49ac76c4f9d8aff9a16f96c25f3cea820ea96244586434e533b1b0087f365986ebe19bfe4a7eab9b57e2b41

Download Submit