9c3dfe947c9196487785f89ba11d118f3eb0c648cbc7c65e20b133ab252795f2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 12:37

Target

2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe
Size

435KB
MD5

5d53a97e5778543731ac9455b37e61a8
SHA1

e2d9b9dd35985ae0d32f843a934a90fdcd3f3565
SHA256

9c3dfe947c9196487785f89ba11d118f3eb0c648cbc7c65e20b133ab252795f2
SHA512

fc28ed77bf65bd0b04b1d3569c65abca60fe5da815db5a268a83eab7a5dba3cef7536abaefb43a23c5b8960cd3d82efbed8c3acb928606af3ca8569d46ead163
SSDEEP

12288:fd4x+ePixnXQjPh9FrEVEYU8E6ksbFtw5kHsTd4VgVwP:fd4x+ePixAjPb5snjU5kHspzV

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4084	63FA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4084	63FA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 4084	2140	2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe	89
PID 2140 wrote to memory of 4084	2140	2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe	89
PID 2140 wrote to memory of 4084	2140	2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\63FA.tmp
  "C:\Users\Admin\AppData\Local\Temp\63FA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-26_5d53a97e5778543731ac9455b37e61a8_mafia.exe 131F86F126A671C78EE9CE1CF89B02F07C33B668D9598B1380D39225B233F6074FB46834D6D0A70516544DD75ED10D62C205356797906092062453BBC7A6DE69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4084

C:\Users\Admin\AppData\Local\Temp\63FA.tmp

Filesize
435KB

MD5
ac23e3ad1a0780fe35186805105ac25a

SHA1
58de5bff04399c2307817cf9d714cf9cd9c25600

SHA256
1839ca03b5ca22720e47740200a322baece82ba18880946b50904bc12872b507

SHA512
5ea58dbd1a16e3e6a2b802331b823cb7824e51e1bea171ca4786f709c8ada619281c4b01ad85b783c89cb2c55295e8eec298d56bfe18f3d6ee6bae4f52c3e38e

Download Submit