345c67f1aa69a8be4fdf6f37aadef290be7aaf9b643bf29a0d55ffd78e0c5aec

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 16:39

Target

2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe
Size

433KB
MD5

8312962f2f0aaed3f059c08d3aefdb46
SHA1

0bc34ddaad0f460c9145996e28c9616a7342b599
SHA256

345c67f1aa69a8be4fdf6f37aadef290be7aaf9b643bf29a0d55ffd78e0c5aec
SHA512

f21f81f26cfee959ca54fd67e5c37075d28dcb8f4a6079ab39c2d6aa1feee56d66a511b88b164b63d4196ac1e27ec387faad2a3dbbe6c5f42284c96ed5c218a2
SSDEEP

6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvF3ZTKTyP1C34GsFfcX6e/Dmml2J5yn:Ci4g+yU+0pAiv+cTs1CgfSSu2Hyn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4008	83E5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4008	83E5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4008	3572	2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe	84
PID 3572 wrote to memory of 4008	3572	2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe	84
PID 3572 wrote to memory of 4008	3572	2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\83E5.tmp
  "C:\Users\Admin\AppData\Local\Temp\83E5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-19_8312962f2f0aaed3f059c08d3aefdb46_mafia.exe AB3F02E53DA3BACC8A16CBAF82D0FA81FE24896B40FA9BEE4D165F1373A9F249212F2C9E0FB364202C90D89D7949018FA11D171ACDD7B1A895AB8442A3947198
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4008

C:\Users\Admin\AppData\Local\Temp\83E5.tmp

Filesize
433KB

MD5
a1bc7b4e09aa6561a65506f99696173d

SHA1
8b8ca952fd27f582aafb24c2a96f84de1c3a6821

SHA256
d255b56fbeaa3b56bf63c332884117bb84f06d0f10cfcdec357cec39bc2357e9

SHA512
38a7e1fae75632ee8a18a542305e52506ba7f6e6f4d3d427d5be8a2b73eda770662e15500b14bdd134018ab66e2f2e0176ffd133667b242bd60fc49315919a09

Download Submit