f1949fcadb93b214c0c5d41624b4ad8d988c13f63d0011b30779d7acd48730f0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 09:41

Target

2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe
Size

479KB
MD5

88193ea670c24c285511bcf2bb460690
SHA1

77e320d2096c05e741b2916e6f99618581ddec92
SHA256

f1949fcadb93b214c0c5d41624b4ad8d988c13f63d0011b30779d7acd48730f0
SHA512

00112666973ee2c21bca415e7d9679177ddead4e7c0df554b78672083c115f7104de57961a8cb84b3b9a0fe54df85069600b447ad0472f89378beec24ec039a9
SSDEEP

12288:bO4rfItL8HAArj9SoC9W7I399NA+Q75UO:bO4rQtGAud3s+VUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4120	4287.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	4287.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4120	3584	2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe	89
PID 3584 wrote to memory of 4120	3584	2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe	89
PID 3584 wrote to memory of 4120	3584	2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\4287.tmp
  "C:\Users\Admin\AppData\Local\Temp\4287.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-10_88193ea670c24c285511bcf2bb460690_mafia.exe E15E6A7A960FFA105A6B4EE9F1EC6BCC1372D5E3D63A583D6C46ABEBA61F740AD5A447C5264FB407104D76ACC455AE1E370419423FCEABDA329086297E4BDD9E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4120

C:\Users\Admin\AppData\Local\Temp\4287.tmp

Filesize
479KB

MD5
3aad07b2255ab4dfe439c521f5cd900a

SHA1
8c78180558a71588f052e902c4f7cc60279e6b80

SHA256
4424e642e3ec4f16f59e3f33469d55b962cf0514a656362bfb145440b220cf6a

SHA512
b86351edd5d56b93defd63b2638821cf6ac0c7bc82c731743ed5e3ae05ca6beb9da6a088a7f8c49250aa01e18168188ffa55f18888ce6a64b591322c68087597

Download Submit