386e4e33102822e89c6f3dd6244f33da000db89ef712c5c2eb0a44d39a262b7b

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 07:25

Target

2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe
Size

476KB
MD5

265a50de24c09c5c0085bd1355d8cd49
SHA1

5bd433f13144cdaa64d1fce072dbb1debf24773a
SHA256

386e4e33102822e89c6f3dd6244f33da000db89ef712c5c2eb0a44d39a262b7b
SHA512

be1e6b3cee9418bd98f88ec3eeee55028c77902280afe85f58e8cdc0a6e37c425a84d65a0ace9f81c9f4324e9f39341af7ff09a164f418c111a74ab2dab0217c
SSDEEP

12288:aO4rfItL8HREEZQbpk2WFXrJvDMoziOE6eog1uQ7K9wlsDpVFd:aO4rQtGR1Kba2WF75jGNj1v+9wlsDpVT

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4208	4120.tmp

Executes dropped EXE 1 IoCs

pid	Process
4208	4120.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4208	1372	2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe	85
PID 1372 wrote to memory of 4208	1372	2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe	85
PID 1372 wrote to memory of 4208	1372	2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\4120.tmp
  "C:\Users\Admin\AppData\Local\Temp\4120.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_265a50de24c09c5c0085bd1355d8cd49_mafia.exe 69142DA06F29E185CD4DEDB95F338D614F4EC7B9B19E687EEE5C7A48EA7677C1EA532BE1BE50FABABEEB99C373DF5FD08922B9FA871FD9E3D8A1A38318C56AD0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4208

C:\Users\Admin\AppData\Local\Temp\4120.tmp

Filesize
476KB

MD5
b7134702f3e6e481f098d1c06aba9276

SHA1
3c6b3482917507c94079d04b3ac3db69057b354c

SHA256
baccc5515a2aad018fda784ed565864386aaac329e27d75ca958a7c137f3e572

SHA512
46797fa20775ae76c599249f9cb7d9b9ab617304bfe9ee4356351d648237063549cea45b5411780309d828a43065deca90fada5196bcb0aeeba469cb4d800b1a

Download Submit