a27140a3f299a4f44984c7df84a625662f06e92bd4de70f6b36918849a407a4e

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 15:37

Target

2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe
Size

486KB
MD5

567c2e216cd0e9d6e40fb493d42d2318
SHA1

719834a0032be41f09c7f5c34eed000a7ca0ece7
SHA256

a27140a3f299a4f44984c7df84a625662f06e92bd4de70f6b36918849a407a4e
SHA512

a0e2a39b4b9aca18d18b3474212a47653c8df98fb4f4066c5a915026c4d2910c6a0258418d24c638584a78046e8103f140e7b3a3fa374e9b53eb7094ab3ad917
SSDEEP

12288:3O4rfItL8HPdplNXSWYeWEjrIeOGxh7rKxUYXhW:3O4rQtGPD3XSyjEeOsh3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2600	73B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2600	73B9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2600	3064	2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe	88
PID 3064 wrote to memory of 2600	3064	2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe	88
PID 3064 wrote to memory of 2600	3064	2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\73B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\73B9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-25_567c2e216cd0e9d6e40fb493d42d2318_mafia.exe 31D0F73008823BAB4A0734A64BA04D3BE3E8DCC8E2EE96C13CEBBAD23CC78AC332F316EA6BBD0469316C53BA32E7F3E3CC74BE00C4AD7F10FA99D58E037ADE3E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2600

C:\Users\Admin\AppData\Local\Temp\73B9.tmp

Filesize
486KB

MD5
4b16f5eac828a0331f3a8aa36965093f

SHA1
24ef624b3b0aedecbdb017de4d9354e033ba3c82

SHA256
5d37515892a5e07a97c540591e2ffa7d727c87f3ea5101b9df2e07b26e6320fe

SHA512
03bffbb6c7b6444d591e73ad23c313474aecd6fc8a89e33010bf86fa5c9de937d2a2d2ce8b4b9516bf421ec2963c81b97a3786df0fd3f1737bce43e5d4bde483

Download Submit