497c574880982e11cec85655bb49077ee4b8c8a6c99172cf27f301ed1b5704c9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 11:25

Target

2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe
Size

448KB
MD5

028ebd1f1a4f4a39903851506c4e4ca7
SHA1

f4df2cd035360610ca8d7936eabb05fb9019b55f
SHA256

497c574880982e11cec85655bb49077ee4b8c8a6c99172cf27f301ed1b5704c9
SHA512

192a8a70008421dc9c8e1fda16ec684eb534b213daf02d5eebe465cb95c54fceb6ab8047058867cda54cb13a0de342e4ecd71b62dc55492eadf998decf84faef
SSDEEP

12288:lb4bBxdi79LaIqyozXX6UkihGflNiyiye5:lb4b7dkLRqnX+ihGflNiyiZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1960	3E8F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1960	3E8F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1960	4820	2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe	89
PID 4820 wrote to memory of 1960	4820	2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe	89
PID 4820 wrote to memory of 1960	4820	2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\3E8F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E8F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-19_028ebd1f1a4f4a39903851506c4e4ca7_mafia.exe 63932465567AF816473E3822B60137BD9623641581D955861BF6C72FE4856AAD8D339C6F6AA5DA2BD32E0FBEC7E5559B3106BCC8BF30E3213E26A5E64105091A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1960

C:\Users\Admin\AppData\Local\Temp\3E8F.tmp

Filesize
448KB

MD5
9a12a25b94c33ff86916dbd8e6690012

SHA1
60515f7dff7f6555fb0d9b715a5c24259473f6fc

SHA256
177502412c9de12c78e7ff9dbb2d74b881164fe26c4c4f90b55fa1ab9cbe00cc

SHA512
e0bf8817ce33616447bfb95644d997056f8fc1a9ecb650fb0ed539506f4f3dd572db194eac1e1ba51ad11e71cdc84c849abecae6d60416132340a8957312e460

Download Submit
memory/1960-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1960-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4820-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4820-4-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download