fe00655fbbfba82387ec08383c28bb74e7cd28574e58367f9711405ce8a3903d

Analysis

max time kernel
101s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 07:41

Target

2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe
Size

443KB
MD5

9b5c31bfec5f52283446d69454067a21
SHA1

9739b2b909e5fd1ec796c40c35d15a37edd490f6
SHA256

fe00655fbbfba82387ec08383c28bb74e7cd28574e58367f9711405ce8a3903d
SHA512

2755d125655302f1b507ebb880dd1fcc67d1ec54fa307d855ab709a0180934cb9ca041146719788efb25ad4eae72451bb5ee187085071dad115347339d2d10eb
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYIn7sghJ090/UPsVC5ZKybIzYlEirFJku/+lMa:Wq4w/ekieZgU6hhTSsVv8IzpykA+lMa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4800	49BB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4800	49BB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4800	2964	2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe	85
PID 2964 wrote to memory of 4800	2964	2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe	85
PID 2964 wrote to memory of 4800	2964	2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\49BB.tmp
  "C:\Users\Admin\AppData\Local\Temp\49BB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-20_9b5c31bfec5f52283446d69454067a21_mafia.exe 8277A4C4E4E97BF752A864AE3026C20137B23DDAAFEE7528268EEC6136D3ED47BC91C67168B8C7BBEE9B018AC3FB42A782FC73B91EB73962B0BD6E3C629CED00
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4800

C:\Users\Admin\AppData\Local\Temp\49BB.tmp

Filesize
443KB

MD5
860b1b2e00fc3f46bc1b8b24d69bfe20

SHA1
5242f8b1a1950d4f4489e223411b2bbecfa5b6c5

SHA256
7e9d48aacd1495c771b7398ced957d9db7d84a49c5495a37916c2314d97e558c

SHA512
41026ff2f3a784299afae5ba23ab0c8fd7fc7dfe9d8029c6a1c0fe1e5ad1cdccaccf0b81c486a1ab629d9c5718e3f2bd9cb69b65f6fee405823dea765c674468

Download Submit