cd98ed0cf3dc343cc69fb9c426d6229a8098fc669c964e6eee19a3bd20466119

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 09:49

Target

2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe
Size

613KB
MD5

60cc17dbbfa249f0f1ef26613a6903da
SHA1

ce6b952eff1ba7de539fe4a74499508c467656f9
SHA256

cd98ed0cf3dc343cc69fb9c426d6229a8098fc669c964e6eee19a3bd20466119
SHA512

e19b37219d4438f874650637b98d823f3f2eaeddbb0108cda13cfff87f6b5c9f7eafc53f797416fbc8d2d9fb3e54e542363602256a2941a4a15d9b7bb0987b51
SSDEEP

12288:XO4rfItL8HP8QGAiDi+w49Jh9yeq7Q8mO4rfIt+2:XO4rQtGPQi+faeqdmO4rQt+2

Score

7^/10

Deletes itself 1 IoCs

pid	Process
964	3374.tmp

Executes dropped EXE 1 IoCs

pid	Process
964	3374.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 964	3248	2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe	88
PID 3248 wrote to memory of 964	3248	2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe	88
PID 3248 wrote to memory of 964	3248	2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\3374.tmp
  "C:\Users\Admin\AppData\Local\Temp\3374.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-13_60cc17dbbfa249f0f1ef26613a6903da_mafia.exe 056713E07FFBBD38729765F5F7161E853B3BE6C4454400A895AC64CD0D5785D9BD79D0FF10DA2C5867A685C23058F690DF82F0BC2022C95E2B6985C5F6F6D4BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:964

C:\Users\Admin\AppData\Local\Temp\3374.tmp

Filesize
613KB

MD5
31cf00c11cd4a04c7abc69bb14164caf

SHA1
edcc5f3bf0da60684e1d1d438b1e46eb58d51e16

SHA256
bdb90b85c87af4c49c1f0cf8cadf76eba9f269dfc8829e6f6feef5db6b79f0b1

SHA512
adbf1b8c30a6a38cf430ddcec460bf23f885001eab7c418cb8188666261d91c578c1736ca7c2d056653bae919783367106d4f763aef48b7983e9e0cc505aae4d

Download Submit