aad15c79b4cf9ef2c89d13f07ffdf9193061acb1f30eb86878bb64d748693488

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 03:40

Target

2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe
Size

448KB
MD5

50965dc678cb0e0878aec5f86081298e
SHA1

8e4c9012bc77b2ab7c2b31c26d8a85a47049a48b
SHA256

aad15c79b4cf9ef2c89d13f07ffdf9193061acb1f30eb86878bb64d748693488
SHA512

0ab6675784d133be6b5430030992c78211ab41029328aa870dd182267818051ab28fe1b6302654c741b336c2f128db281585710dee739e4a388916ba1ec93972
SSDEEP

6144:3FrJxvldL4c5ONK1tgRbd1s79+i5+B77SwfVBTAfX6IQ8E5iwRSx5GEHLAEX1JYW:lb4bBxdi79LWffTw6kySXHLjPaxowSyS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1020	41EB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1020	41EB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1020	2988	2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe	86
PID 2988 wrote to memory of 1020	2988	2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe	86
PID 2988 wrote to memory of 1020	2988	2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\41EB.tmp
  "C:\Users\Admin\AppData\Local\Temp\41EB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_50965dc678cb0e0878aec5f86081298e_mafia.exe 58F6B41A3A78C73BB1F8610C2A30E19E31D972C379678B2FF6068B915DD45EAA416EC596D150CD9431AFB9BC812AC12BBD218F00E4E41C2496638AAECF8DE7ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1020

C:\Users\Admin\AppData\Local\Temp\41EB.tmp

Filesize
448KB

MD5
56cfd82c14239aa2de55218cdb151cad

SHA1
92c977bf2ef888d3b1de52f3420a9e9330fde73e

SHA256
3a844414039482059bf7e822535d64bd15213a59a32224e4b8aeb979c855e00f

SHA512
b3046feffcd54b9846c7b01c8a2ece55b0af5b0e19d34799f8f13f6ba6811635455959827a6452c8860687cb38b8acb2867f5f7f3e6a20437ac033bc12888b58

Download Submit
memory/1020-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1020-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2988-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2988-5-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download