be162208b9bccdb90aac042d2d818a0f8c5e29c33ab8642892dde51391418cad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 02:50

Target

2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe
Size

479KB
MD5

e099812b6768204cdc0820bafd6df411
SHA1

dced8824c51a096e0950649b7c732344728d4f8d
SHA256

be162208b9bccdb90aac042d2d818a0f8c5e29c33ab8642892dde51391418cad
SHA512

ff1f3a43d7d76f4ccbc50ce3219e37eb0554f889626020c40465b72221faacab06ae3458fe26c5aa461fb321f25d467b61163b86e2f7eed5515a67b6d5ef1a22
SSDEEP

12288:bO4rfItL8HAjZ8FvW50N83Tvt9vXU5Q75UO:bO4rQtGAlF5OqX/U5QVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2244	4FD5.tmp

Executes dropped EXE 1 IoCs

pid	Process
2244	4FD5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2244	348	2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe	86
PID 348 wrote to memory of 2244	348	2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe	86
PID 348 wrote to memory of 2244	348	2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Users\Admin\AppData\Local\Temp\4FD5.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FD5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-23_e099812b6768204cdc0820bafd6df411_mafia.exe 46815AD83259F3181A1C21BCE77F928450239426D58B489A63444778CAFE4F9C4B1633AC32D90D171CA7518FD18E7C6726ECD3D39CC531A6BD9E50385375BAC5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2244

C:\Users\Admin\AppData\Local\Temp\4FD5.tmp

Filesize
479KB

MD5
b9908d7afbf84e32f26e55f770c0e3b3

SHA1
5552530bb2780e878604e0192b2f8c1c09e242cb

SHA256
939d8d2526b533cd5d853cd6857f11d2a641db32c428addbb92c012750f5fbdb

SHA512
32f347170956dce75e1e24cead63314d64cb95f9f22cbac67f5a79b3223ebc999b98044ab0b4474ae1de67f09c57dfeddf344699de94f696234fb7f41bba11e5

Download Submit