d04b0f27ada5d20a511ee860342b7c19708838e6943aa22ad19992bccb2deacd

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:54

Target

2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe
Size

384KB
MD5

fe24a7a2de77db695add5b24697713b9
SHA1

9314aecb963bd83958f534fcce5af3da37f2e94e
SHA256

d04b0f27ada5d20a511ee860342b7c19708838e6943aa22ad19992bccb2deacd
SHA512

f8a3fbe0c2fb7c0afdb32b6c3a0c6ba87511aa393f278d119fc26c93caec6645c0d3563a31cd1a979fdfbd850e8406539cc60b3709f25991951927933af438aa
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH0V/jaEnNU7rNjkd3mDbB9sZ:Zm48gODxbzCVErNI2D19sZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4964	58AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4964	58AF.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 4964	2912	2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe	88
PID 2912 wrote to memory of 4964	2912	2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe	88
PID 2912 wrote to memory of 4964	2912	2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\58AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\58AF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-14_fe24a7a2de77db695add5b24697713b9_mafia.exe AD6ECCFEE40D26C561EC81E135CB6D297A500C17F50CDA8E2B939A5014753BD539A0485CE984C95E06BA59ECC0E6C5979024E1E1A7D7128104B99CE7372BA4AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4964

C:\Users\Admin\AppData\Local\Temp\58AF.tmp

Filesize
384KB

MD5
5456ea98837a9cf30d557daa915d334e

SHA1
f9d91bd1395d4692da2e34f376c693b1d9c25d81

SHA256
1f2dea2e57c01978eafefa65ff7c818924738916d042f4daa36d7850fa6bfc6d

SHA512
32c4f3351374b7eb80d036fcd1ed71d6162178639684e0aa201539a24cd2f90cd4b321818ec58d0bdfd62e0696a48e87614349c6b21c6d97330d35f8f3d30f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\58AF.tmp

Filesize
128KB

MD5
70bb02f7a67fa5d6e75d770c8ff2a91e

SHA1
c3a57f8127ee4cf62695ad2ea17199df1db77f7b

SHA256
2eafd094bc28bae62f0d4a7da35726f1d10e190cfe1c69f48b514327e1fb754e

SHA512
6aeba4f5c883b19eae38acc77ffcdb51c47a63a5ccb589ac79e91df89f1435ca32abea0794afc2066994c7cdcf57fd72b73f8fae73f02c08697fb55a14ce8122

Download Submit