23c97ae163bd2422893ef9dce2a1fcc090c6115a4e02151080fd62cc8b46d542

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 05:39

Target

2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe
Size

468KB
MD5

b3c3d88c4e645c96b06372450bd7634e
SHA1

b5abfa06dbf8abd1182243738aa307e3a5012506
SHA256

23c97ae163bd2422893ef9dce2a1fcc090c6115a4e02151080fd62cc8b46d542
SHA512

ad8f3e68011a67016fe9b87d76c74bacf691b33f46b1e6df5c355000198b67cfff9001d1b971e7f247da74480cbebbb6c6f6cd9bab0e350947fe7f27d26dc91c
SSDEEP

12288:qO4rfItL8HGTT/p4Wj92cVN03kDbs7pfS+7bWmeEVGL:qO4rQtGGTKW52cP03kbs7pq+umeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1332	49F9.tmp

Executes dropped EXE 1 IoCs

pid	Process
1332	49F9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1332	4120	2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe	87
PID 4120 wrote to memory of 1332	4120	2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe	87
PID 4120 wrote to memory of 1332	4120	2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\49F9.tmp
  "C:\Users\Admin\AppData\Local\Temp\49F9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_b3c3d88c4e645c96b06372450bd7634e_mafia.exe C28C786E76C88A81650B6B684BB3DB72A773B75ADAC5BB7B3B19A1D2923347EEE3C7F074FA85ED1281E07D89DF7A687416C141EB5BD55549289DD4B012B89C18
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1332

C:\Users\Admin\AppData\Local\Temp\49F9.tmp

Filesize
468KB

MD5
f0daa957750933a476be5c1a736d2c52

SHA1
0b3ebc04a61d4aaf20dbe85fb57c2b6a627fdcc7

SHA256
992450c15b2c261f901206bc6d53467b9fcdd6c58e608b0231d34d4b17242199

SHA512
49d62e75d80999a238d7d59c67f14912cd5671b811042980d0729521de880d4584f80c7b77f14c5ad4a6e10075683a819874822e69ebbab5f6a2b12a9e214a86

Download Submit