80233de6e11d544ddedb00d200ad70a37691889d8a79afe0225b3660fcc4cbd9

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 20:41

Target

2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe
Size

468KB
MD5

0accd1ae5a09213eef2f7a124ab5d459
SHA1

03591210b40453da2c79a281e9e627be696ac351
SHA256

80233de6e11d544ddedb00d200ad70a37691889d8a79afe0225b3660fcc4cbd9
SHA512

6a462a046a347573c688b29e99127e4ce3920fe48f13279cda984db700c0cf1b1e649737b5d496086e85e9e20a44396157768f1e53b0c68ecfa6a40c729a9479
SSDEEP

12288:qO4rfItL8HGxfVX5m32jg+HiyFTNVuTtxsg3xuv7bWmeEVGL:qO4rQtGGxlQ32E+HfruTMMuvumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5204	4B51.tmp

Executes dropped EXE 1 IoCs

pid	Process
5204	4B51.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5204	4032	2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe	86
PID 4032 wrote to memory of 5204	4032	2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe	86
PID 4032 wrote to memory of 5204	4032	2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\4B51.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B51.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 1C957E27038FF4220BAF7D25F70D37E63B5E2F4F0CECD4B863A98FC614A5E46D5A3CABF6F376E76473F887C7548E11DB2D2DB6430DB1B9EBAED1FAB628037D52
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5204

C:\Users\Admin\AppData\Local\Temp\4B51.tmp

Filesize
468KB

MD5
213ee1c7e72ee251206b25e06b603f95

SHA1
accc1462399e95801fe25e0e08537a1abeb88a2b

SHA256
3eb5ceab5888674afd638d54fda90898e32d72d46ced26f7285cbdb46dc5bade

SHA512
1023550161ad6bd0d7bd95c436f9213fcdce35d289e9e7beb95f8b465b7e09d8c0aaa233e9066f667c8e9e43d232fb26e6a43141e2d0f8f12fe534ba57611fd3

Download Submit