560598fc36f7414b529bb1f8fefa5abee086f7542930d908e6ac25c5de403ef5

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 00:50

Target

2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe
Size

479KB
MD5

ae5b64e717e425c7679bb8d836502a05
SHA1

10d26252654fe9c00cf4a06aa2f3600526dcff2e
SHA256

560598fc36f7414b529bb1f8fefa5abee086f7542930d908e6ac25c5de403ef5
SHA512

be992f9ae3d2e9bcc0e4991ed04e093531261bbaf9ab6f3e92c721a00107bfcff54e19208393cf17fc0650c9ea17d47458a9307606cbd0ac639e18624ef00d7c
SSDEEP

12288:bO4rfItL8HAc+n9Z9VqjcGAmkS3RUP+RtyZ75UO:bO4rQtGAci9fM/eEdiZVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4672	5275.tmp

Executes dropped EXE 1 IoCs

pid	Process
4672	5275.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4672	4980	2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe	85
PID 4980 wrote to memory of 4672	4980	2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe	85
PID 4980 wrote to memory of 4672	4980	2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\5275.tmp
  "C:\Users\Admin\AppData\Local\Temp\5275.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_ae5b64e717e425c7679bb8d836502a05_mafia.exe 64AEE6668F71B80172BE7B7DCE0030A7507DB774A60B8BDA0B1C9E4703652A25DB3980C4502130E9F4A7C93611F6B113AB169D949550CB713CBE1D76D6B325C6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4672

C:\Users\Admin\AppData\Local\Temp\5275.tmp

Filesize
479KB

MD5
f993c61690c8d0e08ec57bab9c5cd567

SHA1
62ca0dd591f24d5e5cfce475864532e85dc296c0

SHA256
11dd69b3046ccd313943211a492d3865714e07ab85adf7e17fe3632f5f00d1c6

SHA512
d5c183705144c1e302a5920043a87573dc44697527d8221c71e5b594a027f271ac5474350db895a5a6811a490999084759044ba5234cf3346468a1c0239e5847

Download Submit