e0fe6a10f6643894309d1445d778e41f0cb9a04f9ce4ecc20c25022b2a22579d

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 00:27

Target

2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe
Size

384KB
MD5

1a5c1dd0b2685e7d16d3a570a2b1105e
SHA1

ce88b56706deeeff409dec79fc463cf6effb4f08
SHA256

e0fe6a10f6643894309d1445d778e41f0cb9a04f9ce4ecc20c25022b2a22579d
SHA512

efd8f2877e5944343d26734350cafceee0704ba501346b9abebf4b2a6cb4e6f03b432eb9755bfe1db85c33f9f8204befdffd1a790afb8f6044281a9b99b63106
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHAWaMFlYJwQ9JAmpDsI0xXou2Qk3vZ:Zm48gODxbziWRyJwC5yau2QuZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3308	3A1B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3308	3A1B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3308	1512	2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe	89
PID 1512 wrote to memory of 3308	1512	2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe	89
PID 1512 wrote to memory of 3308	1512	2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\3A1B.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A1B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-20_1a5c1dd0b2685e7d16d3a570a2b1105e_mafia.exe BCE63C891BE1F3D2F894040568D45749DD0D7B19DA2B4719D7DE8483297889A649072AA75A4301733E065BA46EE168EC126AE32215057C7FC4FC504DB453FC2A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3308

C:\Users\Admin\AppData\Local\Temp\3A1B.tmp

Filesize
384KB

MD5
e745b287366fc509d8f201932be1a645

SHA1
da92f7acc94016ec3ae0a4af1d8c320edbfea27e

SHA256
fedbbc40470035dcc111e94f255308cf8cadce0e92067dc64eedea37bfcb9e83

SHA512
56aad56e4abf93c7f7f99b710178199048c0b619b8b50c69c84e524015d116c7df5442a8d5fb7eda4937597aad83399e420b4b165c5584f82eb96c0953d521dd

Download Submit