e0af6a836be86bc8a02218778380929ca088501c727fa8d1221bdc178d88d5f9

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 19:37

Target

2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe
Size

479KB
MD5

6b776e4ee978ee31573037101ed09d42
SHA1

88d4bfc7776fb465fc502beca797e009d76a4a45
SHA256

e0af6a836be86bc8a02218778380929ca088501c727fa8d1221bdc178d88d5f9
SHA512

c8383f92c588f2135bbd7910ca976df0ad54d248fc44fb3638644112727cd6af7ed6050f5279b6ee461b9b98645515a67c6d8e354dbff93d87bb51ec297e98e2
SSDEEP

12288:bO4rfItL8HAnphpQxqVFmz6PY0Nw875UO:bO4rQtGApwxqHUgVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3892	374C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3892	374C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3892	2472	2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe	87
PID 2472 wrote to memory of 3892	2472	2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe	87
PID 2472 wrote to memory of 3892	2472	2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\374C.tmp
  "C:\Users\Admin\AppData\Local\Temp\374C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-24_6b776e4ee978ee31573037101ed09d42_mafia.exe E7BBA08BD230DDC7887190B243850AF22F7DCA33AAEA1BA51E2E9DFBAFA82A78339A88EC7693C4E48900E740BE415B01A3E3DFCE3A3686973C97FCFBC8CCD2E0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3892

C:\Users\Admin\AppData\Local\Temp\374C.tmp

Filesize
479KB

MD5
1bbc5f6bf92792ee83369acb9d68f141

SHA1
aa6ea8033ab37262fc8b9676bbf97df5e00a2522

SHA256
54a45169de6010b625122e5784843664d082ec36243d10ed14e510f12b96cccf

SHA512
559fc7622a199e40f7bbf766b69c587e00a466cf705dd04a5fa07036e9a6808d0e365a2351911ddf1bbd5f403bb3d80e04b166aac65767f5fd678191a9135eff

Download Submit