53860344612b5b7d90cab299c8c8db8e6fca62b69f9d6e5249a833b7e86e009d

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 19:05

Target

2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe
Size

443KB
MD5

ba8dafa1afe9288622ce55c6711df536
SHA1

28c7c80bda83b4199557605535d7456f08210e4e
SHA256

53860344612b5b7d90cab299c8c8db8e6fca62b69f9d6e5249a833b7e86e009d
SHA512

d6e5ff2df1fb2ad4a208e87f3a37383c9c0daf90ebf96553435a68166dd27256ecf357707f3e94eb75bd640cbf9131067058717fbb6c0f938c06e08be5bcdd31
SSDEEP

12288:Wq4w/ekieZgU6E5+6T6TfOquYF2gHQCcaKIQlMa:Wq4w/ekieH6RbQd7IQP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1780	F32A.tmp

Executes dropped EXE 1 IoCs

pid	Process
1780	F32A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1780	1120	2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe	84
PID 1120 wrote to memory of 1780	1120	2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe	84
PID 1120 wrote to memory of 1780	1120	2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\F32A.tmp
  "C:\Users\Admin\AppData\Local\Temp\F32A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_ba8dafa1afe9288622ce55c6711df536_mafia.exe 300DAEE9C4C6E5B3BAE9ADA9B3440876F113023350EC843FC5E71DFBB89FA13C49A4723AF122F76DEC65B4194A0643440E8F05A720395156252A0D4D3E1AA035
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1780

C:\Users\Admin\AppData\Local\Temp\F32A.tmp

Filesize
443KB

MD5
78e5e355b83e260fe5e6d19248d8b820

SHA1
6816814d040a45708ba6ab084752d019258118c6

SHA256
a339257f7e3f93b7ab67f7fc1b77db29aa08c53ef72bbc5782643c910a79dcc7

SHA512
413af160495e7d67d92f124cee300295724cb7e6a47f86e081e53feb0b37439e54163f91b7ae7bf6438f2f0ec3f42754f21dc603fb98c734538e578a7d9e5aa0

Download Submit