451970a9c2bf336e5cf0f1f7e3b01f9869fe72fb5fcb1e3250e6dd823114f7a3

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 08:56

Target

2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe
Size

444KB
MD5

f47530a60eb8c3b28c6bd1c41af5e1b3
SHA1

cf9da1a0acb14cb6abbf800f36107d39aeb4262e
SHA256

451970a9c2bf336e5cf0f1f7e3b01f9869fe72fb5fcb1e3250e6dd823114f7a3
SHA512

4a24632469193f7bf550916281ba4e1755098b11458caf9063ad4f4879cdc7759cf4aafbb46f19cb77a25a3763e0cf2e9f6635894e97396bb950fd1627bb39c2
SSDEEP

6144:fFrJxvldL4c5ONK1xgWbd1s79+iStJKStnk31NFxLlrhqvwsXr0JEiCJWS2ePPIM:Nb4bZudi79LZSW7LLdK30L1bLA

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5040	2C99.tmp

Executes dropped EXE 1 IoCs

pid	Process
5040	2C99.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 5040	432	2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe	81
PID 432 wrote to memory of 5040	432	2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe	81
PID 432 wrote to memory of 5040	432	2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\2C99.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C99.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-22_f47530a60eb8c3b28c6bd1c41af5e1b3_mafia.exe 0B4C56F5A3097FEFE10D965BAAA65F59DCBD2B2F276814F9A234F94315B6A97177B15F7758E444A860AE28287E327AE7B9B8C0AD1306E93EFE05AFE576840C0F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5040

C:\Users\Admin\AppData\Local\Temp\2C99.tmp

Filesize
444KB

MD5
eefb5368fc151585ab1a9c19c562ecb9

SHA1
8ee70f68d0a923484ca148cc9f573f924de12f3d

SHA256
520102a9593e8fd2a07cfc5b6e9d917cf0679f6aa6f946b1ba709c74a653c57e

SHA512
30c286e8c899bb5013087f8dbe5356c7ee2ca64b2fe5b38b0ebe2d060a42bd9b4931d424c40f53a770c5e86611994ee7a1512129a3510b2d0350a040d0d75361

Download Submit