caf0931d0b3b5a81629e839c382b8835228c4c8d53cdababf7d2503bfb49620c

Analysis

max time kernel
134s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:49

Target

2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe
Size

411KB
MD5

ff77a8061474dd5d1135cfffa7c12329
SHA1

c7b65aedc4edfd55a39e4d05d1703db72df4a0e6
SHA256

caf0931d0b3b5a81629e839c382b8835228c4c8d53cdababf7d2503bfb49620c
SHA512

abd54b987f703f9d4359356c18094418abcdbbf4778408b9efbc52482de86020408ff86b54f8ae20d9411396a44f6d5e23ecc84c2da2f745d21d350dd080f01d
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mF/9S2KWjui7WuWwSrrCSQYMh0ussjG8l4tt/O9qHI:gZLolhNVyEyVCvwevMhcsjNwt2qHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4464	3A88.tmp

Executes dropped EXE 1 IoCs

pid	Process
4464	3A88.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4464	2696	2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe	90
PID 2696 wrote to memory of 4464	2696	2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe	90
PID 2696 wrote to memory of 4464	2696	2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\3A88.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A88.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-13_ff77a8061474dd5d1135cfffa7c12329_mafia.exe E0FCE701564A4243B58CDD79E1B6381CC461F7CF932A2306A64EE6A9E3E3D0C1BC1CAF6C763D37DD49B597C1603CC6656A166BFE8A4A4F82139068E10FD73578
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4464

C:\Users\Admin\AppData\Local\Temp\3A88.tmp

Filesize
411KB

MD5
dea73aeeb91a9e354731a843fdcb04a6

SHA1
4159ccf87d210905bc974f6c27d31c9d63578005

SHA256
1f063a477c9ea36d4087309a79d7360509def9204e6eac311e508c5bda75c756

SHA512
69c652fec5c4d3700d1abf83c619da1489c81e9ed81f6cb81aa1af199211cd5c4a3b5a0862168a671dc0c435043ef52af1f2867ec20a1b9af8a4f4eadc1145e1

Download Submit