a6b1857908f9308f9b0008fab73a7dd6d9e9707230d6eb97fe3c4b2288241908

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 19:27

Target

2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe
Size

444KB
MD5

f5dcbbc491f90d9519f3f1dc72bf65c0
SHA1

d5990ec0c14719975d510ad4e705f4ab5984ddb8
SHA256

a6b1857908f9308f9b0008fab73a7dd6d9e9707230d6eb97fe3c4b2288241908
SHA512

8b38ce2ce3037d129c6a47b4c01d95c9b9129b521ff6a3afa0945653b48d175a81a75cfa9679e2b25b55328c632b2001e4478955e1cee9b45efb258cdd72185e
SSDEEP

12288:Nb4bZudi79LhgTJ+vst7uBoQxfHsH5QA:Nb4bcdkLhuJ+vstKBo8fHi

Score

7^/10

Deletes itself 1 IoCs

Processes:

81E2.tmp

pid process

2168 81E2.tmp
Executes dropped EXE 1 IoCs

Processes:

81E2.tmp

pid process

2168 81E2.tmp

pid	process
2168	81E2.tmp

pid	process
2168	81E2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe

description	pid	process	target process
PID 3872 wrote to memory of 2168	3872	2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe	81E2.tmp
PID 3872 wrote to memory of 2168	3872	2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe	81E2.tmp
PID 3872 wrote to memory of 2168	3872	2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe	81E2.tmp

C:\Users\Admin\AppData\Local\Temp\2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_f5dcbbc491f90d9519f3f1dc72bf65c0_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Users\Admin\AppData\Local\Temp\81E2.tmp

Filesize
444KB

MD5
869f1d341c6fc315dec46ec7c415255d

SHA1
c19655fcfbb6568cc09f76795fdb4e9f4013de53

SHA256
6c46b6e28506f9eb228ff43d18e4387b5ec0be8e90be3a7761faad973560e890

SHA512
065eadbcf8aef3f11f36a20953668920827fcf958e1eca0098ea7f89ecb0847012380b744e5bda3edbab97825e2f0065e2bd071adf191213f0dbce26863290f1

Download Submit