329199e6b2a1b18172806934aef3b3ade2f139b74e00b350cc68f987c89004f1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 12:47

Target

2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe
Size

479KB
MD5

da7ca201e72522eb76ba0416413b923c
SHA1

734cdde0f14c775f72d0424f0115a87a93b5ecb6
SHA256

329199e6b2a1b18172806934aef3b3ade2f139b74e00b350cc68f987c89004f1
SHA512

131cf92d7007a307f72cea049a4f48c8582c62c36c65b57e5880ca1cc849059d38176828c0944e5629cc27dd4a4b250a40748636ee80ead329332f47aa311238
SSDEEP

12288:bO4rfItL8HAFeAx+8q9CMB8CstuxRcBRC75UO:bO4rQtGAd+J9iLtYmRCVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2372	325A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2372	325A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2372	4384	2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe	87
PID 4384 wrote to memory of 2372	4384	2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe	87
PID 4384 wrote to memory of 2372	4384	2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\325A.tmp
  "C:\Users\Admin\AppData\Local\Temp\325A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-16_da7ca201e72522eb76ba0416413b923c_mafia.exe 46F0361D323FF84734C46E1376763F18849E66206E327FC0DFEC6A89D260EB4EDC547434E4DF1AFAE39AFB665719891A047DA17A05844A73A8FC203299C55C3E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2372

C:\Users\Admin\AppData\Local\Temp\325A.tmp

Filesize
479KB

MD5
edb6b0247ba031849b19991b4e9fd77a

SHA1
1539f18bc44b12ab3408ab74c0228383a25f546a

SHA256
cfef64031ed92f06c437568c7949d4b8a8bcc1533e29ad0e2e4da8c2e97d1ada

SHA512
f91049a0a25315b3aebc445aabb04b84d3083e005615697082ce7a9a1586d63baab1ff7cd4371b7f8b4a08f5ce9d48191bab85b376762043206c94f2b9a7b262

Download Submit