35ad9be61acb1fc4a7c7ef1b7f3ce35d821403f7b7b9fc6e868cceb2e550d8a9

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 05:43

Target

2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe
Size

486KB
MD5

5c3f6d4bb7e432700b26fcf4b345e9bf
SHA1

945771541886ce3d3dd98006a0683cded4791e4e
SHA256

35ad9be61acb1fc4a7c7ef1b7f3ce35d821403f7b7b9fc6e868cceb2e550d8a9
SHA512

a9a179ee2e817528f31a47afd8125799901cab6b5bed5e3f19dedf313d911c4ebc4b13f49e33ae619fac23327db89900b3a799cf0cece98d1aea7af07fd74c06
SSDEEP

12288:3O4rfItL8HP8M1rNwURe87ScuRSSk6lUPRbZiWdaY87rKxUYXhW:3O4rQtGPnj98yRPjiWdaY83KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1688	69A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1688	69A7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1688	960	2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe	88
PID 960 wrote to memory of 1688	960	2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe	88
PID 960 wrote to memory of 1688	960	2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\69A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\69A7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-05_5c3f6d4bb7e432700b26fcf4b345e9bf_mafia.exe 547DC463C2FB8671B2078C625EA14025C794A35B94E70EDC65D98C1A1FBF23BF01C90F78EA52FD16E30C331485C69D016C2B9C6CC1022CA9F81E7D6D4CE939A8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1688

C:\Users\Admin\AppData\Local\Temp\69A7.tmp

Filesize
486KB

MD5
c35646547d3cd8802f55c08ff3f045f2

SHA1
ccd13a7f41055e08b87d6c1d4a42a736a5571129

SHA256
7440b848afa6806f206ed51a773635587c7f3ff98f47461b48cbb01e23bbace0

SHA512
17f838636a2bc096a729bee8b316ac244cedb569123350e47521e46e2d60f6c6fc00dfd15388f45fc5ebc0b40b75a9eecff851a6a8fe5328fcd9b410b0aac63d

Download Submit