5eac441e26c74afdc71f98cc701a71b60f31c95c520cf6b97342451c16cc1a9d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 15:25

Target

2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe
Size

384KB
MD5

29ab14f680f4a6a6f46ec11b4d632d0d
SHA1

cc72d5c4cf135f4834c53f6a6a2cf5f5ebcd5ef4
SHA256

5eac441e26c74afdc71f98cc701a71b60f31c95c520cf6b97342451c16cc1a9d
SHA512

fdb36bf45598e10dc9fc37d1506c3ec40ad82fedc3ddb126c98f71a6d2f683954f887c3133b73b4b9e10fa69b70aea32762498b0062a1db9098e74d641de2fad
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHyWVuHSvONFnK8OUYKt90nblDkcPPttSrpZ:Zm48gODxbzgWVuZtnlC+OPopZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3376	4016.tmp

Executes dropped EXE 1 IoCs

pid	Process
3376	4016.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 3376	680	2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe	84
PID 680 wrote to memory of 3376	680	2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe	84
PID 680 wrote to memory of 3376	680	2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Users\Admin\AppData\Local\Temp\4016.tmp
  "C:\Users\Admin\AppData\Local\Temp\4016.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-17_29ab14f680f4a6a6f46ec11b4d632d0d_mafia.exe 3D05AC71F0CF4B510EA8EE508983646E4926796031DD5BB21A196C4E5C70917B2A12496A62BE93B7B871D94FD634FB5CE261D6B560525BE2D33D05E5CDE496D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3376

C:\Users\Admin\AppData\Local\Temp\4016.tmp

Filesize
384KB

MD5
524edb3c745bb3491298d4e96336cb38

SHA1
814a692bef9ce8e3109b332b28469580aa77f4f6

SHA256
e970e44da4ad04015c2392c9cdf2b7553c9477682d977a8ff3865784a7c41bdb

SHA512
25e446009846234079dd2650c7f813fd647c49b8510f9532cb276172a4b676c95d606e43a818c3c33e11123f495d4c6fed2bcec2f95e94e2adfa0f368d141c40

Download Submit