3df5640326ed5fa58cd2c3411c5d40e31dc20feb2b8170b4fb894a267a05bfd0

Analysis

max time kernel
155s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 08:40

Target

2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe
Size

448KB
MD5

b73960db0f36c55342168205f2551b10
SHA1

4707da88502e4dd3fc2031c4143282f631cc9e51
SHA256

3df5640326ed5fa58cd2c3411c5d40e31dc20feb2b8170b4fb894a267a05bfd0
SHA512

dc7aac93f69b65d3aaa9ce2c4c2483d3a34ae595cd30f72f2d55f164ebddc493763d1e37a6fffa04a049275b11343164112ba61b7f5feb2864222dd5546c6eee
SSDEEP

12288:lb4bBxdi79LHKwwI2OehEN2W/4B+n5VcS0jA4:lb4b7dkLHKnIZ7N2WgBETv0b

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2868	731D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2868	731D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2868	4368	2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe	86
PID 4368 wrote to memory of 2868	4368	2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe	86
PID 4368 wrote to memory of 2868	4368	2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\731D.tmp
  "C:\Users\Admin\AppData\Local\Temp\731D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-27_b73960db0f36c55342168205f2551b10_mafia.exe AC0F7F2849C32DD5CB960738F299668ED2AABFF348083E342E4792410CD8E745B614FB5704C05F9D9F23BE750B02B58F5E46CD86BFD301E08E036BB36C188259
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2868

C:\Users\Admin\AppData\Local\Temp\731D.tmp

Filesize
448KB

MD5
2c13faf62d5272679e60c62fa9e2434c

SHA1
7c0c6bfd8219ab1cfa4bf5d4cc605ced0050e85d

SHA256
e2e74813d930420cc8bf5e99a7b64c04f1b9bd2611c94da88029b4811db47b32

SHA512
c441fd9b2d036cd343162669232077af9b604cddc3466ea4a4234842cde03eb69b453ff0997869bc7a2f4c862f138bb6e99dd9f5838cae523d1346e935b7dfae

Download Submit
memory/2868-4-0x0000000000760000-0x00000000007D9000-memory.dmp

Filesize
484KB

Download
memory/2868-7-0x0000000000760000-0x00000000007D9000-memory.dmp

Filesize
484KB

Download
memory/4368-0-0x0000000000140000-0x00000000001B9000-memory.dmp

Filesize
484KB

Download
memory/4368-6-0x0000000000140000-0x00000000001B9000-memory.dmp

Filesize
484KB

Download