e38cd8e2335bfbf23f722d3ade322bce9e9253463cd3a67fd743db225f5037a2

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 03:42

Target

2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe
Size

428KB
MD5

09288092c9a3708cd9afafe51dad8b73
SHA1

173eb3c461de9e5451173e077f1f1a10578124d9
SHA256

e38cd8e2335bfbf23f722d3ade322bce9e9253463cd3a67fd743db225f5037a2
SHA512

ef39dc3a1ad878ec8439f022776c948f73b2f5ea324b05c3364daaa3e1995105db084921dbe899769ef5e1b35ca5b937682c5cd13f9592a0967484349e8fefb4
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFzROMNBPle1E4dXVz99N+iGSrvx7cj+jrNqHR:gZLolhNVyE4lVkX3vxz0GrNqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4336	4517.tmp

Executes dropped EXE 1 IoCs

pid	Process
4336	4517.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4336	2404	2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe	88
PID 2404 wrote to memory of 4336	2404	2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe	88
PID 2404 wrote to memory of 4336	2404	2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\4517.tmp
  "C:\Users\Admin\AppData\Local\Temp\4517.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-23_09288092c9a3708cd9afafe51dad8b73_mafia.exe 6B63EC22A968BCBCA3FFC009032448ADA68D9E2697686F9DD97988D29AD17F12EEE56E0E4E5EB3A98778975EED9C32C9F7EBFA6C8B3F7800303F08BC9659B2A1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4336

C:\Users\Admin\AppData\Local\Temp\4517.tmp

Filesize
428KB

MD5
48de7ab7ec677ddce365a607a5814ddf

SHA1
21ad51b5dc426ec0e67f698b5ea1a5b0342ed410

SHA256
23399e08d7e950a5e1aa7f9f5024b467cd74ebbe5053f4405a463d4a5e991b6e

SHA512
50fd5531e2b52a25a29f1e2583b10a2a1620dd59c1622253abd66cebf7913210254bed0ca2dbd8fff67eb2fe4f046abe4f6fba33f9e05778b58dff574f721c7d

Download Submit