46112e302efdb59c6cae422fa8331c0295a7dd31a1dee79862ee604684067bfe

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 20:33

Target

2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe
Size

428KB
MD5

3f2f4bc7e0882920aa3dd2f4945ca5e6
SHA1

d3f9cf60918a404a47ccd7a18f3b559c5a8460e6
SHA256

46112e302efdb59c6cae422fa8331c0295a7dd31a1dee79862ee604684067bfe
SHA512

8be033c002851c133397790ee17f530f6760349441d9d41542faa4ceb30c83d145a9c514dafec334db98547a48f49ae7f54ce203038fe1cadd7e9a323230f2e5
SSDEEP

12288:Z594+AcL4tBekiuKzErCXsXaPKOej34lKlFl:BL4tBekiuVrCqWej3N

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3676	6438.tmp

Executes dropped EXE 1 IoCs

pid	Process
3676	6438.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3676	4772	2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe	88
PID 4772 wrote to memory of 3676	4772	2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe	88
PID 4772 wrote to memory of 3676	4772	2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\6438.tmp
  "C:\Users\Admin\AppData\Local\Temp\6438.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_3f2f4bc7e0882920aa3dd2f4945ca5e6_mafia.exe 78E76C2CB5655D81B982A13138C2A8702B86943FE10C9FCF132B6C22BC2BD5C01A1494CE4566CF629AE1147484667F9A80658647D59CC617485465403B50087C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3676

C:\Users\Admin\AppData\Local\Temp\6438.tmp

Filesize
428KB

MD5
ef040af8c512d8247a06060ffd95b80e

SHA1
56eee3f5463d9cf9327f9498cc51af5477743709

SHA256
7424a7f3edc9139e5e0e223b437e2dbb2ed87ca152a2fe2f0fa0983dd391bd09

SHA512
28bb968d6f16a8d3056a81be98b27316444a948808dc015b6f387909cc20f16e9a57d7a2e5db6077fe4f7481fcd4c5955c4ba822f53db53373c8b1b8a7e80492

Download Submit