72676cc9291552132c5d3581e436d5be4fcc33dec8680c476a7214e35480c5bc

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 09:34

Target

2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe
Size

468KB
MD5

4dbeea6d116a8664876640697c9627ca
SHA1

9a0dddc477bc2139c70595f13226266812ea35f9
SHA256

72676cc9291552132c5d3581e436d5be4fcc33dec8680c476a7214e35480c5bc
SHA512

8e98e04c1b91593a99360645cdfdd1655878b460fda9b343085c1be05c25ef3b478e0f7f76a630a8238f087fad26ba9cfe0dd7f076047c7eb0dff10119a22df1
SSDEEP

12288:qO4rfItL8HGWEMGMxKQd6RuQSr7bWmeEVGL:qO4rQtGGNSxKqQSrumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4636	D1F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4636	D1F6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4636	4564	2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe	84
PID 4564 wrote to memory of 4636	4564	2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe	84
PID 4564 wrote to memory of 4636	4564	2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\D1F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\D1F6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-04_4dbeea6d116a8664876640697c9627ca_mafia.exe 7FAF5292145FD8A6E5C7C061A3A4C260CB422D6C35B4C35EA7E128CCC467EFA8DFA064453D3C3E669D6FAFB24772A6707E180E3CE0D1009CD775D01D0CE889F3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4636

C:\Users\Admin\AppData\Local\Temp\D1F6.tmp

Filesize
468KB

MD5
588d89537fe215c5c40fbd5b45abb8f8

SHA1
edc07effa06322d9cc6539f4a8fa0dd46a36ef07

SHA256
6b228ab7a3456deb4848fd4126c7fd55101b3e3e2abd6bf8914376521e0316a9

SHA512
9ccadeba9a55ac0addcfd95538ecfaa5c305c500bb26ad56406125d3be363a85ae45eba7104aea09ad15cb2f46a6d2e5ec6c92ba5ad4ccf33b30088550f42db4

Download Submit