a1470b93d404da7652a9cd3fb4924291e8cc29842f9c9961906037ad11b9ae75

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 09:48

Target

2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe
Size

443KB
MD5

c784c17d447649b285bd7b8bf5c80893
SHA1

0ec631ecdb7264aad3f49915b5e0018cee1d2ce6
SHA256

a1470b93d404da7652a9cd3fb4924291e8cc29842f9c9961906037ad11b9ae75
SHA512

dd03b177b46fe5d36fc3cade715e69ff27e6b7ddbce67adf7c2e65920db49090acf3fe4fc761ebf2d5fb9ca02fe05f41e8a1324eaa9f23bab5bc04dc068b1587
SSDEEP

12288:Wq4w/ekieZgU6cyoCoYz13Fi4GgnKMc5Kxnl+lMa:Wq4w/ekieH69R13FiJgKM6gl+P

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1380	6F92.tmp

Executes dropped EXE 1 IoCs

pid	Process
1380	6F92.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1380	4084	2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe	83
PID 4084 wrote to memory of 1380	4084	2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe	83
PID 4084 wrote to memory of 1380	4084	2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\6F92.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F92.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_c784c17d447649b285bd7b8bf5c80893_mafia.exe 82D68E478007DB31252F89EB19FD66E15D54E7974E4A0FFF02F2B1AED5061BD99A41B9426ABBFB23E7C872855A5F0EF5CC09F87641938D1335020B37ED4373E6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1380

C:\Users\Admin\AppData\Local\Temp\6F92.tmp

Filesize
443KB

MD5
7ff3c71cf3f215dfbae1fff35b8ad80b

SHA1
2a199a9a8a4c305eb50b8576335b95e1fd2e1baa

SHA256
165e36d30c0d208573ceafcb2dbfa5f42cbbb1fb35eb67335d92a1bc31e3a159

SHA512
de1bc2471439b36bd0a85071bbdcf7f0b1f36a30c6bfc590f9f14f2887eb90b36acd5b0019025c313c1fae0c102be8ec8b4a029461be2d87c2c7cee869cb9e5f

Download Submit