ed56b1388c79fb4f65c1a3b1cbfec891d2ae2bc90a65bed6186cd7d2182df0d5

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:01

Target

2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe
Size

476KB
MD5

ae41e33bba3b913ca533d405031b6544
SHA1

ea313428b73500e9f5cc469fa878b7bc2890e3d6
SHA256

ed56b1388c79fb4f65c1a3b1cbfec891d2ae2bc90a65bed6186cd7d2182df0d5
SHA512

ee3c88994c94476df7b416ae237ca6fc5b384a27772a22fe8b07073854de056bb11664d5e4352c27324309f59404a47b2c2ca7499a804ba68abb6d4ad394e771
SSDEEP

12288:aO4rfItL8HRk8uCulQU9PlibLDbbvtC7K9wlsDpVFd:aO4rQtGR5Ghybb1C+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

Processes:

EB2B.tmp

pid process

4688 EB2B.tmp
Executes dropped EXE 1 IoCs

Processes:

EB2B.tmp

pid process

4688 EB2B.tmp

pid	process
4688	EB2B.tmp

pid	process
4688	EB2B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe

description	pid	process	target process
PID 3248 wrote to memory of 4688	3248	2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe	EB2B.tmp
PID 3248 wrote to memory of 4688	3248	2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe	EB2B.tmp
PID 3248 wrote to memory of 4688	3248	2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe	EB2B.tmp

C:\Users\Admin\AppData\Local\Temp\2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ae41e33bba3b913ca533d405031b6544_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248

C:\Users\Admin\AppData\Local\Temp\EB2B.tmp

Filesize
476KB

MD5
1e2db9b1c1bb2161e0384f6631225e09

SHA1
48900b4c227f947e9c81852e59404e43598bc459

SHA256
b5140117f6f03028937e9c57cd4ab1172acd6ac1b6726e483e700bd05f54fd45

SHA512
a5b8583292eb7c43f296b8e8833b92a822591b93f4a804a16949e31f1bc4714fd032578377345bfb026903b84c7eb36cd32a833ef0954583a58f3bbca67e819f

Download Submit