5fb885655145c2fd4935c8a1bf1783adab999d223ee3687e84dda9b4e63c7cb1

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:50

Target

2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe
Size

473KB
MD5

e387d96bbc5c509dd7dd8ee7b0bf2257
SHA1

58d507bfdd817847446837d90a7c9eac1e724392
SHA256

5fb885655145c2fd4935c8a1bf1783adab999d223ee3687e84dda9b4e63c7cb1
SHA512

8d7d66e572170c5f063ea7e1a1e53544601f3c8ad50f1b286dba4f9ea4fb67da96122d2855ad25f7641b8cb63eec43fbac3b9acce71754a70e5743fc11d25670
SSDEEP

12288:Nb4bZudi79LmCFTvBTotMXcvku6dBtLRnnA0a:Nb4bcdkLm8TGQccptLI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3972	566D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3972	566D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3972	3776	2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe	87
PID 3776 wrote to memory of 3972	3776	2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe	87
PID 3776 wrote to memory of 3972	3776	2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\566D.tmp
  "C:\Users\Admin\AppData\Local\Temp\566D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-14_e387d96bbc5c509dd7dd8ee7b0bf2257_mafia.exe 7DC26E43EE8A00470ACF0B26DA678A25CE7A8B71B5C76B1B4162911A8FA47438F901DDEFADAF2B79B375E8AE729DCDF9C84EDD22C5546D50E49569B38DB278A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3972

C:\Users\Admin\AppData\Local\Temp\566D.tmp

Filesize
473KB

MD5
a49aadf8d361222024dca71e1052f80c

SHA1
641e10dd3e11e461b6503e38251332ecaab08739

SHA256
15dca503bc8057b4183ec9d9a16c92a269326f23891723c63134a5e4c3e9ae20

SHA512
0dfbca46d883958d7b9b7f03cc0deaa7f03c9c4a296b15cc0f71a29a9e15f725d6f597fb5ee6e4137e6de16823bf8eb67e80e71a6fe8f3cd9e2c70fba4ba7e9b

Download Submit