72223ac5770f08eb149327b32f96d0e2a0e8df2ba6bc4e6272b102e1488c9fe1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 06:10

Target

2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe
Size

468KB
MD5

917946563f16a17e174edf1aa71d1024
SHA1

ce2611d3434fe1a487a1ae7bb4d97a437ec2b3fb
SHA256

72223ac5770f08eb149327b32f96d0e2a0e8df2ba6bc4e6272b102e1488c9fe1
SHA512

e8d661f4694fb397560851d285bbb74a3060f223d47365bbf436dde777099018e390c23d2939fce2043f81aa78eadaae9c3dbbf4ae8d300497c2bc7bf315b187
SSDEEP

12288:qO4rfItL8HGBtaaV6MXvrvZAUZrMVyNvxviVXwVww7bWmeEVGL:qO4rQtGG7gwzBAUZrMVKxvDpumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3960	3112.tmp

Executes dropped EXE 1 IoCs

pid	Process
3960	3112.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3960	1596	2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe	90
PID 1596 wrote to memory of 3960	1596	2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe	90
PID 1596 wrote to memory of 3960	1596	2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\3112.tmp
  "C:\Users\Admin\AppData\Local\Temp\3112.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-10_917946563f16a17e174edf1aa71d1024_mafia.exe 4F8070C484BC8E06076FFF9163CC562947D2EC6C2AA9C6B99EA4247C5C1DFE5DD8BF304A2FE3F099D76C8A80890AE31033EA88CB8525B5F4006EF2A4D5DD3E0B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3960

C:\Users\Admin\AppData\Local\Temp\3112.tmp

Filesize
468KB

MD5
5d255a235f47bcad7eabbe50c959806e

SHA1
b8e996fbff52856376bc1e693623aad64dd2df67

SHA256
5dc9293442e8a702734165e085f59d98f6164e1781424f9e021f9879794b1c65

SHA512
8a9682506b5cae832b1225d321408da2a1b6eea8d82c94024ae22ebaa7f04c66a94c6db92bfe7d83c317616dfb2ffa5a68381c0d9927d11e69864d63be80af1a

Download Submit