258943cdb400f1723c64056b6bf6015315b7a480f7773c8c0b935e7471062d2c

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 23:29

Target

2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe
Size

411KB
MD5

5a128c44ad92f3a47ec3475b3b9c4895
SHA1

c9b2fd5f5dc805759e7f6404ac67a1ac7bb96fc1
SHA256

258943cdb400f1723c64056b6bf6015315b7a480f7773c8c0b935e7471062d2c
SHA512

1b825fc637afee51498a3309b695fecf56368f54e9fcbd28ef0be9f828eb5716f384df3e0dfabe82c2966daead525ebb93486d1970ad787be60ebd9419a4a7fd
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mF1zX2seSBxmtqd63SwsbNfUK2xqHI:gZLolhNVyEkzX2+xwVsbNfr2xqHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2008	49F9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2008	49F9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2008	4500	2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe	86
PID 4500 wrote to memory of 2008	4500	2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe	86
PID 4500 wrote to memory of 2008	4500	2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\49F9.tmp
  "C:\Users\Admin\AppData\Local\Temp\49F9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-07_5a128c44ad92f3a47ec3475b3b9c4895_mafia.exe 85441AD9263EFF52F07B0F60331BD97A083B3424842D1BB2AAF78351AE26327FAE83F9F7E2A9121E6AD698DD9B1F0C3563ABD6A2A72D45C452B6A3241972C949
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2008

C:\Users\Admin\AppData\Local\Temp\49F9.tmp

Filesize
411KB

MD5
c66d153f39b3086d0b5fc7d2b9015793

SHA1
c5db6d1a0476990c5e66b70e561e13b5500afca1

SHA256
8001c5713354abcf216c2b90d6063df1658d29863411faefd939e71ccae98e57

SHA512
895f6f2992dd9208b1baad67ba85ce8fe5351b41fbab01140804bce82db6487c387585fae9a2c7fc9541298da3b2f57c68cf223e1579dcd087ae7a0ddd79a8d0

Download Submit