7b84c532c68c485cefc11ffae9b9799cb62acc7f849bd8b810fe78b7b50c0443

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 19:28

Target

2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe
Size

486KB
MD5

44f96357d51ee019085d5e69c36bde86
SHA1

c5d65f899e9a31d98aa52da7e65dd16e5a967438
SHA256

7b84c532c68c485cefc11ffae9b9799cb62acc7f849bd8b810fe78b7b50c0443
SHA512

630e74c3d33daeebfdbdde397b734bd9835c688a8ad973ac507754cf5aa1770098a959d1f230722105a285fb9dd391b12906aea92f0c7dc7ac6d32fb64037c63
SSDEEP

12288:3O4rfItL8HP/tE4jLVmcD3DmKz2di7n12jhPJ37rKxUYXhW:3O4rQtGPO4XYETvCU7n1k53KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4776	494D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4776	494D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4776	3636	2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe	85
PID 3636 wrote to memory of 4776	3636	2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe	85
PID 3636 wrote to memory of 4776	3636	2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\494D.tmp
  "C:\Users\Admin\AppData\Local\Temp\494D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-04_44f96357d51ee019085d5e69c36bde86_mafia.exe 4ADD1ECA8A1F36F1F6D462208F062FFF455FFAF85D2EC7A6774C7E2AA91D6642B4D6A82EDF4777523E5A7C25F182D78D8519C2FAACE0132ED2923D24004A2051
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4776

C:\Users\Admin\AppData\Local\Temp\494D.tmp

Filesize
486KB

MD5
b9db52ab67e5e4ca1fee18df836b793d

SHA1
b16d54510d87b17fb39d672b51e5ca7eb4e3678e

SHA256
c3b2bcc98120ee57c4672c5991415b5e65fc8cba2f6422dec94ab6992c6fbed1

SHA512
fa506df90b3b74f0b04023d6fc5833d680d9be89599d4d25da02fe774bec9d328d1338bd3c56036f0bf419898043f63ee86e3cd29f86d15923e2d25a078320ff

Download Submit