1c6de9dff6c5ee545d06d72aef47fb23126c4aa6f55c2f461e9df21cf022e224

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 20:42

Target

2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe
Size

433KB
MD5

d195fffab03e72a4d46f351cd78d4ea2
SHA1

861bd0e30ef0f239452d4cb9152b54ee0d43f715
SHA256

1c6de9dff6c5ee545d06d72aef47fb23126c4aa6f55c2f461e9df21cf022e224
SHA512

ab920a172a99eae691c4c8dbe9bfb1767c6cda86aae6dac79559ea1ba775345dd9246dfaab6a20e368003e7264e2d496b04f062e8afb660c99ca0e49ccab445b
SSDEEP

12288:Ci4g+yU+0pAiv+tUeM1O424x3ITyScJyWxdn:Ci4gXn0pD+LH4rLysF

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3656	6BAA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3656	6BAA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3656	2556	2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe	84
PID 2556 wrote to memory of 3656	2556	2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe	84
PID 2556 wrote to memory of 3656	2556	2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\6BAA.tmp
  "C:\Users\Admin\AppData\Local\Temp\6BAA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-11_d195fffab03e72a4d46f351cd78d4ea2_mafia.exe A8385D151C9485752221B306E9613F9ADEFB0167A704153F5CC5868041688CA6C2FEF8BC4EEFFCC03F71C4FBF51C9F4CA1B55DF315DCBAA42A19B00AC618F0A5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3656

C:\Users\Admin\AppData\Local\Temp\6BAA.tmp

Filesize
433KB

MD5
0f18808c1bb940e82ad563e40d26a2a2

SHA1
2cb841479db0b1ee6f4451c5152a991356f34a51

SHA256
9048d165aa908505fabc11f3f709739ff46e45d20c52f0ad5af9a36fffa25092

SHA512
3ce91059c5950d0b00a234a6ce71c11b11ddd08be87943e2c5c68105dd8a7d02646476061619bd8e383c867d447725af82db133000a62f0ef26675126fe99598

Download Submit