a7c9b4f61c112ef9eee62d652cf60c500a0d081092af736a36121d83c939bf5f

Analysis

max time kernel
93s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 06:37

Target

2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe
Size

468KB
MD5

45dfc48ca2ff234a7b6a37855525a354
SHA1

2fc2bca247348cdfde91f529151aa61526dacdb5
SHA256

a7c9b4f61c112ef9eee62d652cf60c500a0d081092af736a36121d83c939bf5f
SHA512

62606154af984eabfdd7ca4b835dd6a6362407632a8fb96d6bd324f597198ca514ba704c03b0f0c489454c713b6b159365593ddf7f7e620229f46fcbd68fd1aa
SSDEEP

12288:qO4rfItL8HGEelC5fDXNb3YLqsKtPTw5JI7bWmeEVGL:qO4rQtGGEewXNb3O9KtPTwTIumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2180	883B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2180	883B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2180	4992	2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe	89
PID 4992 wrote to memory of 2180	4992	2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe	89
PID 4992 wrote to memory of 2180	4992	2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\883B.tmp
  "C:\Users\Admin\AppData\Local\Temp\883B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-23_45dfc48ca2ff234a7b6a37855525a354_mafia.exe B821DB6AD57D528BA8B703A32A889DF59560120F28CE20F762C367B04A21363BDCF530FCD6993E349B209F5083B41C8481CBF5103DC2E4FA18D899A01D6E8811
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2180

C:\Users\Admin\AppData\Local\Temp\883B.tmp

Filesize
468KB

MD5
3b24b7ebcf48e2c120a9174c8a9d43f2

SHA1
52c24f5656ad5d6afbee848e0f39968913e7023a

SHA256
5f0fefb0b9ec79eeb7974341fa56ca0e289f4088f1752d434b595ce965d6656a

SHA512
c3d7d995c11c56f62498b98f61e72f093b69a449d8883996e1203c833c724ff65b84a54f6b47b3a3d352acdabf1e046a6e8bdca8a2ab9f1dc234323926d58ea4

Download Submit