aae934a07ca23ee81b51a641ef4d57efd8e45ce53d1ac089b21fae0b905deb25

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:31

Target

2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe
Size

436KB
MD5

7f6085cac46b319a3c1de82b690dac4d
SHA1

50f132edfb8b750e05478001fe54bcb551198d95
SHA256

aae934a07ca23ee81b51a641ef4d57efd8e45ce53d1ac089b21fae0b905deb25
SHA512

bf27d631074e85fe3530f3ef248f8d5fe117f2ca230973be1cc0926150716f5c137358d760a8b379eccc4fcb023affb880ab85941abe0064bab898c5509ba67c
SSDEEP

12288:aO4GfBtL8HPSvN6hOAzWl8J8FMj69adoJ8FH738rK7X:aO4GZtGPwNkVWurcadoaBQrw

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1468	610C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1468	610C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1468	2212	2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe	89
PID 2212 wrote to memory of 1468	2212	2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe	89
PID 2212 wrote to memory of 1468	2212	2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\610C.tmp
  "C:\Users\Admin\AppData\Local\Temp\610C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-27_7f6085cac46b319a3c1de82b690dac4d_mafia.exe 81D627AACF186AC2BCE79A19AF12770C53776DEA26BCF24855248F18762DB44C11B13AEAA9DF3EFEC483CEE6A9EDD5F5336E3108F80FDBF54D524BC12F6AA649
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1468

C:\Users\Admin\AppData\Local\Temp\610C.tmp

Filesize
436KB

MD5
84bb3e6cab82d7a592b46ed20e8b9922

SHA1
c248ae72ce469c59af822df030a7214d0139d970

SHA256
9ee05167d2707726b1c1d9e28332ac1a8a8b6452037092b96dd682ba84ef489d

SHA512
ad6af4184a4c5bc6c054bf1efe6419ad724fb920fadb4614c69ac713460a15dd1510f1be2fd03b8860d61e3982d1a1a36e9488cac88a46a79f912a7bf41cbcdb

Download Submit
memory/1468-5-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1468-7-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2212-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2212-6-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download