7508f4a49b005fddf3c9974f9acb61cef69ce83de50ea4bd298745ca8e8fdf7a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 05:00

Target

2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe
Size

473KB
MD5

ddffdbf69b1546874437bfda3985b627
SHA1

74fe2d6f96ed8a1cdfc18b1d7b48673527f81d7c
SHA256

7508f4a49b005fddf3c9974f9acb61cef69ce83de50ea4bd298745ca8e8fdf7a
SHA512

71ea13ed02597e1fa24b66dcabd6a0de38aa6f13d3c62fcedaa9316e0682219a22bcd70f068af3292c2d70bd9f3b9f869ada6328011b3c490cd3a562ef14925d
SSDEEP

6144:fFrJxvldL4c5ONK1xgWbd1s79+iStZDBI+sE99kYO0Hty6t66euh+m4mo7xxgmfr:Nb4bZudi79LC7994Myn8o7x0uUA0a

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3972	5EBA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3972	5EBA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3972	3908	2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe	88
PID 3908 wrote to memory of 3972	3908	2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe	88
PID 3908 wrote to memory of 3972	3908	2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\5EBA.tmp
  "C:\Users\Admin\AppData\Local\Temp\5EBA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-12_ddffdbf69b1546874437bfda3985b627_mafia.exe DB3F67C75C0140E58AAA669372D94C54230FE83CE49C7E6BAC4F7CCCBB91C6C5C990788969E0BFE1F04A275485DA7C1D8B4A7072FAECCDF365C6F1EB8ECBCA7D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3972

C:\Users\Admin\AppData\Local\Temp\5EBA.tmp

Filesize
473KB

MD5
fd764220313e5a44b1878c8800c4b992

SHA1
4fd5e10d8e6947641f6491c7b582581aaf0071b3

SHA256
4f5f0d611897509a7d505b0e77de2757c3fc974df14a57e97e889a54c3dd1220

SHA512
d1e373c992672f218a37c3aa10e41f6598730ca62e3f8887f25cf6fae98d82b162b6a56042ca35afda76e9e25e0de2d8f51ab596c5090bd6202bb43aac785c58

Download Submit