58fb47739a47ccb15981b119acf796c8adcbd7ec2994850f6c70fb0a92896b20

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 12:35

Target

2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe
Size

441KB
MD5

6ca7427b30759cc24fc1c29923b303a1
SHA1

fb2903575afe2d08bf9aadf8965df3d411a77105
SHA256

58fb47739a47ccb15981b119acf796c8adcbd7ec2994850f6c70fb0a92896b20
SHA512

996308c6d2f6bed4871eaef9cc9fd56555648ff65720b0b5a1f3ccadb76c6d2b00f6d8000c19f8de16e0d087dc4213ea9fd5e69cea5f4778d252f64b017373a1
SSDEEP

12288:6i4ET7+0pAiv+vWl4iHG6QT5eEAXYbKzZE:6i4ETK0pD+OvG6rEGY9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1832	68DC.tmp

Executes dropped EXE 1 IoCs

pid	Process
1832	68DC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1832	808	2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe	89
PID 808 wrote to memory of 1832	808	2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe	89
PID 808 wrote to memory of 1832	808	2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\Temp\68DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\68DC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-19_6ca7427b30759cc24fc1c29923b303a1_mafia.exe E8AF96459870CBE71B68968463876A619534CD0BC87CCE263349266F3599A9AF48F4DD519D729031BF4F5BE19628F5E741BAD6611EAA6145F685FBF1BC8FC606
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1832

C:\Users\Admin\AppData\Local\Temp\68DC.tmp

Filesize
441KB

MD5
8eac31a19e2492a1f2f7b9b39e6cf959

SHA1
46c0dd706ab10466c65313ac860d7a79797a5111

SHA256
6a5285f56cd9e8d83dd4491471d6ff9f1c554a3cb0809436009fa7857766a56f

SHA512
c258bf7a3e9ce64ac08c604fd5aeabd801e8f321a32bc679bc30ba38f7b694aecdac1698d37d37a203e13bcbabc09740498b813ae7fa4e1424342b8cdef1339b

Download Submit
memory/808-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/808-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1832-6-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1832-7-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download