c82cd5379380802054b03ddd47fe32d4b6d25e4c7b48b42abf05c44423b81518

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 20:23

Target

2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe
Size

412KB
MD5

5db8a6ccb65c5cf7e4031d9fa4082b96
SHA1

3352bc4d8cbf293ee9740fc286d61b6b469b21ca
SHA256

c82cd5379380802054b03ddd47fe32d4b6d25e4c7b48b42abf05c44423b81518
SHA512

a2718d8e3f78ac68777a257b0018ecaad90c8fe6a589ad9e6022bda526427046c2baefdf322dae50d4a530d5879565172804a0e6f05ded6aaed74c9116eea476
SSDEEP

12288:U6PCrIc9kph5YuSO5qVOq1l3Uhy8kTanfXN:U6QIcOh5Y+5gOPyBTanfX

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4148	4D74.tmp

Executes dropped EXE 1 IoCs

pid	Process
4148	4D74.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4148	3056	2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe	88
PID 3056 wrote to memory of 4148	3056	2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe	88
PID 3056 wrote to memory of 4148	3056	2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\4D74.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D74.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-05_5db8a6ccb65c5cf7e4031d9fa4082b96_mafia.exe 7B7753C4DB370506628506AC35E91DD11CD08C8157A97E184D8EC7B167875CAB66D131F8474CFFD0E5AB5A70B2913E64C15DCB3AC3BAD17D598A767168D1F4EF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4148

C:\Users\Admin\AppData\Local\Temp\4D74.tmp

Filesize
412KB

MD5
6687c6464fdf5b6a04d50ba77c71d805

SHA1
2580f29efef77c18fbe2636bb1dde2ebeaad38ee

SHA256
494700f2d97f45858af68717c646d9e3529fae85c7cc607bac5d0385ac92e282

SHA512
e388238b237cdcd96e0f34d0d737d22ab42ec3f62b0ed75ba8a6943804e5f2eae39e1f77b821438d99ba885bf705c990705ea70a20cb51fba9316d2595e52f8b

Download Submit