86fea582c43ba58d1da84c839c2936733d9a0bd6ad7181d2c901a9d53dde8bbe

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 15:39

Target

2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe
Size

433KB
MD5

7f7001c4f63edd5cdb48b0ba66be9eb2
SHA1

081574d261ff837a9ce6a6d94d2e699686743c64
SHA256

86fea582c43ba58d1da84c839c2936733d9a0bd6ad7181d2c901a9d53dde8bbe
SHA512

b0c969ad0b61788a7ba389b51dc2c4024a2c41166abed4799613136e3b15d24cdf1226cac1eebb9b7b0baef197069ef3164eec216a364cf0cf1922822e9af547
SSDEEP

12288:Ci4g+yU+0pAiv+TVcFZ2wMqtG1fTrgOfg2TOn:Ci4gXn0pD+pEUqExTEOfra

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1984	46FC.tmp

Executes dropped EXE 1 IoCs

pid	Process
1984	46FC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1984	4236	2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe	88
PID 4236 wrote to memory of 1984	4236	2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe	88
PID 4236 wrote to memory of 1984	4236	2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\46FC.tmp
  "C:\Users\Admin\AppData\Local\Temp\46FC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-06_7f7001c4f63edd5cdb48b0ba66be9eb2_mafia.exe 235482E2F9B1A03EB0E903E16E6BA012E1608AC5C26C18D8D827546CED6639A664ED0A895AEB8D0ADFE9DBD4B7A8A3D623949E66C09F77216C5AE7017ECAC9A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1984

C:\Users\Admin\AppData\Local\Temp\46FC.tmp

Filesize
433KB

MD5
1841718eea91aa31c2dec76b7e6331dd

SHA1
07151b07fc961658a8f01e667ff8e9c2ed206102

SHA256
8841e3f246fff790cb4d03cf54c22036e3f42e78e8a76bb80058f0859ea58def

SHA512
a14b8a93cde445e4cff342aa801db5d69d1630a9cd146017d66a49adf140d0c9b577b73fec9d5aee7f89746d81e41edc5aa0617995155560d7ac49f7325605da

Download Submit