80253110ea3f8e3b6cdc18a819c0f70ce865faadaa144e8010f938f687799d53

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:48

Target

2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe
Size

476KB
MD5

57cb1e605d4a50dc7e3f95429997d8b2
SHA1

b0a567230e790ed00803f77ff361b52a6c4fc5e8
SHA256

80253110ea3f8e3b6cdc18a819c0f70ce865faadaa144e8010f938f687799d53
SHA512

343990132b50e39964015f19f76416d79b7a3fd599ce5f17d76f0de894698497198832059675734500d5ae923e7d34cb81e2f19655c863e3aca13e8c7fd88eae
SSDEEP

12288:aO4rfItL8HRbAls0Kl+SB4mDU7K9wlsDpVFd:aO4rQtGRbnDU+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1844	F5D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
1844	F5D9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1844	4884	2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe	83
PID 4884 wrote to memory of 1844	4884	2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe	83
PID 4884 wrote to memory of 1844	4884	2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\F5D9.tmp
  "C:\Users\Admin\AppData\Local\Temp\F5D9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_57cb1e605d4a50dc7e3f95429997d8b2_mafia.exe 2D6210710956F758F3A21F8E68A8E6CC020A2D7057BC057ACE978BE081181A701C3192A94B198D8712F81D0AB27F1DADEE44280EF8C6329D23D973773C2561AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1844

C:\Users\Admin\AppData\Local\Temp\F5D9.tmp

Filesize
21KB

MD5
f9e1c904a68815b8329e60e21e4a9cb4

SHA1
f7e02ad17c574e60de51a8d4a32d3aa6ff33a20e

SHA256
413c5c678993d7a16dbd30f581b99f84a983b141e72ad47adcced5e49885fb7d

SHA512
c5a9233ee11218405bed60e85296c759978d54728904437da233a8cc0abb36100ffbf368f752e4a73ee5d7eb8009f0703c4eb41240304a0f21b8d9044afb089d

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp

Filesize
476KB

MD5
39e01a906247a0b30648f896c3a3f9c9

SHA1
58d64b2526b6f4850dae88c75aed3896ac3ac897

SHA256
c6350ad1be11752775aa72e425716767d955944808aea92398fc58ceb127660b

SHA512
ea390278596d7d262e0626cca1a9e80f43e0fea33164353a52fbf07856e0c4df3278383bbb4a81e2d7a9d351403bf35f9ed37176e7ec9a150a0f441c8a637ba0

Download Submit