ea830d56ec7ecefc0cc80facf1800376290c0d58f79abef51c72140e7acb8417

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 11:32

Target

2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe
Size

476KB
MD5

41779255cc88e680cdd9c4368c48151b
SHA1

9460e45e02cfaf549b5d11e89a948c8c032d1dc4
SHA256

ea830d56ec7ecefc0cc80facf1800376290c0d58f79abef51c72140e7acb8417
SHA512

28c828168777ab466bb8bd1972d92af5f53de301df8794001cfeed57e6a46aac750408c77804b0753f840370e8091b46cc3e19d20e68d4025387f6d52072cf55
SSDEEP

12288:aO4rfItL8HRalHPpdybFtyMzEMkqWCqkVn07K9wlsDpVFd:aO4rQtGRaXdmFtyx8WCqcn0+9wlsDpVT

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3196	50FE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3196	50FE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3196	4352	2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe	84
PID 4352 wrote to memory of 3196	4352	2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe	84
PID 4352 wrote to memory of 3196	4352	2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\50FE.tmp
  "C:\Users\Admin\AppData\Local\Temp\50FE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-19_41779255cc88e680cdd9c4368c48151b_mafia.exe AA11E5C4577B39A1C9F367A679377E710555D001F51522B2E9EF5F3125FB30115FA6CCEC669DE1849CE73AA4B716039AD5A81AB22912C15B0EA4811E1FD0A912
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3196

C:\Users\Admin\AppData\Local\Temp\50FE.tmp

Filesize
476KB

MD5
dc639b56d368ca93d403ded0fb11aaa2

SHA1
01f566d113bdd00d4a570aecd98406f1b6924342

SHA256
554801bb25146691ae1d663170c0335b50dfec621a349f7c4254d949abc6feb7

SHA512
32a31f2cb071927bccd6894a26ba763b2a52785bf07d4bca182acf66bcc3b28ac9598c9f1975668708000041d8415c9d60fc95be6064cb4cbff26b0368691377

Download Submit