7d3799b46dc9a6ef9d10727a1c9563c9ac43a373ca19d628bbcf290f4a34d72b

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 06:03

Target

2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe
Size

476KB
MD5

a8ac28ae71924eb08577ef8f805e02d1
SHA1

6cb04c99ecd155ac2959c4ed33a4ccb269a4af1d
SHA256

7d3799b46dc9a6ef9d10727a1c9563c9ac43a373ca19d628bbcf290f4a34d72b
SHA512

f9d236c27c5b04e6c6777eee87c5ced34671bf7981a4e7d368bb065ff260efb2105420229e37c22ca891a1738425e8a38a76021c81abceb3c849758fa8ccae82
SSDEEP

12288:aO4rfItL8HR1YMp8VYDxNlsy7K9wlsDpVFd:aO4rQtGRqMppNlsy+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
516	6F44.tmp

Executes dropped EXE 1 IoCs

pid	Process
516	6F44.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 516	2948	2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe	84
PID 2948 wrote to memory of 516	2948	2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe	84
PID 2948 wrote to memory of 516	2948	2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\6F44.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-20_a8ac28ae71924eb08577ef8f805e02d1_mafia.exe 68243BF6D5C9486BCF8F920D8633C20736707C4863363BD45ABBCB5FDE005629698DBEFFA93174C6466B83D438D60F3BD676D52C067EF5B2C31CA71ABBCB7B35
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:516

C:\Users\Admin\AppData\Local\Temp\6F44.tmp

Filesize
476KB

MD5
6a4517d2b295b048094622a7134f7803

SHA1
dfca8287de27a4ec520dbac927e28f0a784591f5

SHA256
e0157baadfd29c171cd7bd9dca99be9205ebf26645463d76a0dbdc63cd7b507d

SHA512
40f59af74a65bd33ee49ebf65750364d3ff515f5cd9427347023c9a78b3f801d616d387095d0d0547c4d5842d6aac0b4aeb9604747ff809bae7b74ab0eada692

Download Submit