54c9a1efe4c9a81dff6fe96f78b7e1d54930fb26371de116e00790020decf2d1

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 00:39

Target

2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe
Size

444KB
MD5

7f2a96b5ee0cd5b8d091e8918a58bc16
SHA1

a7b951dbae571403268b7709c60410a7f467f875
SHA256

54c9a1efe4c9a81dff6fe96f78b7e1d54930fb26371de116e00790020decf2d1
SHA512

3567d4cd3987bc42a8da801b22eda5f5298e21a87d82b312a999858fc6a717b6089176ee55c3e85558d39c64fce7e7975759a0974b8d6806a3f25585b7da8b58
SSDEEP

12288:Nb4bZudi79L0PlXqvOUuDPk2KFjXJ5WImNZHnKA:Nb4bcdkL0PgWUW4JLsZHn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3712	3BA1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3712	3BA1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3712	2928	2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe	85
PID 2928 wrote to memory of 3712	2928	2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe	85
PID 2928 wrote to memory of 3712	2928	2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\3BA1.tmp
  "C:\Users\Admin\AppData\Local\Temp\3BA1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_7f2a96b5ee0cd5b8d091e8918a58bc16_mafia.exe 46B054B85D55B356E6ABB587537492100313A2BA6D4CEE5C159588229FBB6D6844EDCB93F7C929AA9A587081BB785F90451223CDBD274AA0E973075D57852BF2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3712

C:\Users\Admin\AppData\Local\Temp\3BA1.tmp

Filesize
444KB

MD5
3abbccdf2b98913e33605daa66340821

SHA1
139290a774fe184efab5f3e6691e771307c3cad6

SHA256
24a0925bc76136814061e305bfdbe9c5f5b68b01d5a1a060d2216f83aff953ea

SHA512
2e3b06211d9d5bf998602dd84133d5de34848a90c7a9aa5b5e7c7b4a1150ed86f9e4e188280fe4329f89a3006e11052e4c0dd8c78e51f1d8e925af83f53d005f

Download Submit