3804c36a988f3b1acd6cdba4d8ce826cbe7bac6ae0b4e7edca2f5abb7643ee76

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 10:16

Target

2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe
Size

433KB
MD5

d04e243d315c3d9898ac1b2cea3b3918
SHA1

8a9b1399d35276a223d477dac1076116edbb19c5
SHA256

3804c36a988f3b1acd6cdba4d8ce826cbe7bac6ae0b4e7edca2f5abb7643ee76
SHA512

443df0c878f38b59deee7853c97303a9730bc92b1703fe8aa5e183c1924a73f51f9ab2ecedb2b3a85ec2e7f9b628ffd1bfe5e8f1e39b130e8417946dd6ae3c04
SSDEEP

12288:Ci4g+yU+0pAiv+n9AVYY6Y20hNHX5fLpn:Ci4gXn0pD+9A0rQpjx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1684	630F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1684	630F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1684	1904	2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe	83
PID 1904 wrote to memory of 1684	1904	2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe	83
PID 1904 wrote to memory of 1684	1904	2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\630F.tmp
  "C:\Users\Admin\AppData\Local\Temp\630F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-12_d04e243d315c3d9898ac1b2cea3b3918_mafia.exe F05CD15944AF9EEEC6F0C202570AE8FE4E5B4C3C3EAE2BB598F8648B7FF84E78962B4FBF3DB5A399C083B688FD372FAFE2A69D88658EAE9DE43540EBD54435BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1684

C:\Users\Admin\AppData\Local\Temp\630F.tmp

Filesize
433KB

MD5
e27acb69b2c133da258e0d9cdfd02d34

SHA1
dad8f482a4b6092fc6c76584daaac5c441ad7519

SHA256
c5b6e4a567bd5bbb02c5066a38538e4f9408dbdd70dc2fbb11be0a17f4319720

SHA512
6ec3c776ef0d35f6af860e55f9288e4bbd4682622d6deafd1f80039c7b2b5e339fa006a0acb29287a0146cf9d9f6b8cb5836a3cad72e295604b1bff85607790d

Download Submit