25b031e8bd45b14535b3af8c666f76984bb2d0a293425c355ed6e17430faa1b1

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 00:48

Target

2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe
Size

444KB
MD5

b2a52719f81b0af3314cf145a50639e3
SHA1

149ac4109aea45b8a5bb6f8aef86fb38b4965640
SHA256

25b031e8bd45b14535b3af8c666f76984bb2d0a293425c355ed6e17430faa1b1
SHA512

b37889bf7a47b1c284c643d37ec7e595481f29c59762a7bf9a9f7d776110bebdfb2b92738491290fffc419b9db58aa8b4fa91cba50d52c1ed41c98529dc71e8b
SSDEEP

12288:Nb4bZudi79LhP0q/ohYtIOlcbNsq4Ohj1Uw5A:Nb4bcdkLh74YD2Sq4Ohj

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1176	48D0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1176	48D0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 1176	3676	2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe	84
PID 3676 wrote to memory of 1176	3676	2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe	84
PID 3676 wrote to memory of 1176	3676	2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\48D0.tmp
  "C:\Users\Admin\AppData\Local\Temp\48D0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-20_b2a52719f81b0af3314cf145a50639e3_mafia.exe 2FFEE2BEA05A4219819DDC54A466D08AB4DF9F5FD58950257335D547902B7176BC910BE0FEEBBF9B87F6DA813E76878927E9C89FBEAF9788E676E803074C6266
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1176

C:\Users\Admin\AppData\Local\Temp\48D0.tmp

Filesize
444KB

MD5
8f5288b84ca4cceff43debd36544f82e

SHA1
708b80e53a6371bdeb1d5ceb60960f247626ab41

SHA256
d30264d3f0bd78436be4034fd33297cfdcc7918cfad1f2a42cc4075de893d0f1

SHA512
653e6444ec5d436f414b4d6268e2dd01e9573d8bb29f35c80ac1484a265e2bb310df910f0f924c507b9a3ddfe40398392a811bbcf7e9a5efd48e0b18f100877f

Download Submit