3d22c538bfd4bf90cc60e793305bf9c397fca3823f34b9dda85645e22d39b9a1

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 22:50

Target

2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe
Size

476KB
MD5

86813e886d38a89667231fe5da63a635
SHA1

d123ff4acb2e70f9d6092a901cdd9664745fcd67
SHA256

3d22c538bfd4bf90cc60e793305bf9c397fca3823f34b9dda85645e22d39b9a1
SHA512

d6ace640da33e520b2c9d86712a4f13f47ee8dd1ef3f90ef44f1fed524454db21145d3e1729bdf0cf3b75dc28cbbfaf819b185d04ff87e2472a34218631b207c
SSDEEP

12288:aO4rfItL8HRaOhBqb2JdLrCfBPYnA7K9wlsDpVFd:aO4rQtGRDh3L/CJPYnA+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1516	7FBF.tmp

Executes dropped EXE 1 IoCs

pid	Process
1516	7FBF.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 1516	4676	2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe	83
PID 4676 wrote to memory of 1516	4676	2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe	83
PID 4676 wrote to memory of 1516	4676	2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\7FBF.tmp
  "C:\Users\Admin\AppData\Local\Temp\7FBF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-17_86813e886d38a89667231fe5da63a635_mafia.exe BF8EC42AF774D71B80FF04FC5704586BF0FA064413E631128384836D3BA1181C2C76BB39CE5E622A1FDA71A4CE966F4FB70E496BFCD403540B897EE5ABE1B193
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1516

C:\Users\Admin\AppData\Local\Temp\7FBF.tmp

Filesize
476KB

MD5
c2980f8f5944b0f46b4f543b34c7eb9c

SHA1
079c6fc00c5848030a53a09455363799d33482f7

SHA256
1e6e5a0c881f5425aad99fada6610a19aee55a27e69682e075e26018f6016c1c

SHA512
f961cc0d3972bea8ba5220f11f317f962409b8672d7075f6cc694bd5c7fed2dc580a99183ae0020afd5583f0c5901dc23541de89379b52914d0fcb90ed9353ab

Download Submit