a1df1edb32d1bc8bee9fb36b4cf15eae9e9a4fa64f9b622e007a9a2ae8bf3198

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 14:48

Target

2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe
Size

486KB
MD5

a280bb51f053094184c85cfd8cf3bf71
SHA1

0a979f79264b410b61c2fbd857debe34c181557c
SHA256

a1df1edb32d1bc8bee9fb36b4cf15eae9e9a4fa64f9b622e007a9a2ae8bf3198
SHA512

4a85683ff1b4b8270a73fcde0bd641cec7a023afda3ccbda04856f38396884a0328446f28e26106ec6c1fd0b33ce347bdbb4df04c570a64592a75310c8f7763a
SSDEEP

12288:3O4rfItL8HPdxYYGER1CADCWAIevgq7A7rKxUYXhW:3O4rQtGPd1GEXCoAIePA3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1596	4769.tmp

Executes dropped EXE 1 IoCs

pid	Process
1596	4769.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1596	4812	2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe	86
PID 4812 wrote to memory of 1596	4812	2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe	86
PID 4812 wrote to memory of 1596	4812	2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\4769.tmp
  "C:\Users\Admin\AppData\Local\Temp\4769.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-21_a280bb51f053094184c85cfd8cf3bf71_mafia.exe B29C17FADC5BAD455EE2825A7650BE827681B5D52EF1D032C50A331C9294CDD5AC9297D2AD5D600539ADD41E5125C72407EB1832ED9070C3830702E04FAFF647
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1596

C:\Users\Admin\AppData\Local\Temp\4769.tmp

Filesize
486KB

MD5
5771dd5367c7fed2b8bab84f5033558d

SHA1
2ab1221f4e0a01409ebd1149f502d35c3129c1f6

SHA256
bf001c4d25f7e9782b9fba05af3a8c53e1c86e3c086330bed0f21e3cb3738b23

SHA512
3f5bef69da569d8e316fdf047f635b871dbaacd8758ee95787de55dd2a9f12ede43f4d83b3761dcbc2882dbb9facef4bb25bf9655ef3d3caab210ca7aac8768c

Download Submit