d75f28af4dceb4fc6b20d17afc46f4b7bb4daffd59a07dd94dee6729305657d5

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 05:27

Target

2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe
Size

433KB
MD5

5f2f0ca2db967c77060894f56d3c01d3
SHA1

c0efe78687dfc83f0406a634dd1450f99d972b9a
SHA256

d75f28af4dceb4fc6b20d17afc46f4b7bb4daffd59a07dd94dee6729305657d5
SHA512

0935298f08d784a27f6a870a404fc5ac1de9870ada192fddc806498506498c1bddcd583a7e83f96838003d02ddba75a3293c3e69bdc93c5ca9a81ed1773e8816
SSDEEP

12288:Ci4g+yU+0pAiv+E0/GvyiWvj8ZC/h3cxO0gn:Ci4gXn0pD+E0GSb8QmxO3

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1500	4CF7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1500	4CF7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1500	392	2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe	21
PID 392 wrote to memory of 1500	392	2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe	21
PID 392 wrote to memory of 1500	392	2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe	21

C:\Users\Admin\AppData\Local\Temp\2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\4CF7.tmp
  "C:\Users\Admin\AppData\Local\Temp\4CF7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-13_5f2f0ca2db967c77060894f56d3c01d3_mafia.exe 9523F3AE139A6289C01DD79C11118B5D5A637485412E1705097B25179EB8C9187F4D376336653396B56F963ED40AFFC4A5840CDF4D0D6E31609A508B06779A10
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1500

C:\Users\Admin\AppData\Local\Temp\4CF7.tmp

Filesize
433KB

MD5
b26535200d59e4336c3133797a69a3b4

SHA1
cc685e2c9f898f8001e97c1b5c781f8761ab32a1

SHA256
51059e2bdab9099b6e3c317bb8aeee525ddaba597795ef960b19733a2b628294

SHA512
09c2214c3c6ec7d65aa26d5adaf1897d39846bcd61bb139c2a41bb3f6966a3add211263a7093df7b89c695617c5665ec5c2b3720cc6f6b10c2a96bd0ea2f6362

Download Submit