f650e588098741d7c5d5f116d9abe28d44c6305a21441a3118e9b7366560d92f

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 14:56

Target

2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe
Size

441KB
MD5

fd7572aec057817259e8ad18629d5ded
SHA1

dbc7db8ae68bef04596a732227b9a1e1f6417ff9
SHA256

f650e588098741d7c5d5f116d9abe28d44c6305a21441a3118e9b7366560d92f
SHA512

2a3201df2c650c5c65328214bd1e11406e4b546f00f1d82a1deda7644ca4f1098f51affdd27f8184e15e4a81d9c6ef79beacd4c19eb360b83b989385cdbd818e
SSDEEP

12288:6i4ET7+0pAiv+jF19zhGiGrPmfk/Cyo9hb:6i4ETK0pD+99SJQD

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1920	5B10.tmp

Executes dropped EXE 1 IoCs

pid	Process
1920	5B10.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1920	2364	2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe	85
PID 2364 wrote to memory of 1920	2364	2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe	85
PID 2364 wrote to memory of 1920	2364	2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\5B10.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B10.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe 0C5D9AA6D00E5B9DEE9EE817AF32EC8A58F8406BBF3FDD1F4A7F7C5B1946899AACD1BBA956A918A725F90189010B7A044B8476D292B652CF160C4983B055EF69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1920

C:\Users\Admin\AppData\Local\Temp\5B10.tmp

Filesize
441KB

MD5
93e0604993f992e1a6562666c0f63470

SHA1
be29840e2fec3b19bd60c026d0131b40b7c0159b

SHA256
5b5bdf10df3fee04c35c70704f3c3b8cf6a4dfb5b6c5147fbfb2752fc3e65251

SHA512
d5f5d6b10f8e23f34cf623c71dc362cdd38c074b315bc9cce77aad8ae862bf81592381b53c62b2eb2fff5f2559bfaa007bedeb9c0cc5cecbaf4f59707e305f40

Download Submit
memory/1920-6-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1920-7-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2364-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2364-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download