e4fd66803e7b3083c3a79d9bddb5cd5147413eb092fb34ca57b3d5656239ddcb

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 11:56

Target

2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe
Size

468KB
MD5

e91423336546e33f893fc0b65d17105c
SHA1

6d35c4e578aaafd999a2eee0a7eae6633f56cf00
SHA256

e4fd66803e7b3083c3a79d9bddb5cd5147413eb092fb34ca57b3d5656239ddcb
SHA512

cc0023ed4714b5c5035911eeff288c51749d0a981ffd9421dc1ddebf7c7cb9198413ee47a2a716b5c7335b91d6c634bfbf5f951a34a06af236640324de05a6b5
SSDEEP

12288:qO4rfItL8HG67Yysa3Y52hpozp+yPJ7bWmeEVGL:qO4rQtGGhZSYW+plJumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2360	5D91.tmp

Executes dropped EXE 1 IoCs

pid	Process
2360	5D91.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2360	2584	2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe	85
PID 2584 wrote to memory of 2360	2584	2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe	85
PID 2584 wrote to memory of 2360	2584	2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\5D91.tmp
  "C:\Users\Admin\AppData\Local\Temp\5D91.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_e91423336546e33f893fc0b65d17105c_mafia.exe B9A306CE730CC2F933103683CE5FBABA8BB12DA8F80A2A6532055CBB5B6A1E64FC489A06D8E92BCCFCB7C3BD601D7E0F1009CE6C4CF940AD8E351F4378F5B561
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2360

C:\Users\Admin\AppData\Local\Temp\5D91.tmp

Filesize
468KB

MD5
0094d786fcdf5145ae2b90a3a63399a1

SHA1
4dfcde3754611617f7c73a2ba0b4445a4d703b3c

SHA256
017a8ba43201505f3e7edcf21c01ef3df2508464ecf643609069798c1b0104f1

SHA512
f48cc782e5952a1222dc7eca9db8132a5f4aae089b03520e0d4a37cf1582a25e7ce0e4bbddc18debb3732401a6e3c8ed9453264f7f2b19165c46c41ccd14a5e2

Download Submit