e2438213b322537a94aa05a93a8a732aed075bd1a2ffaa083aef48138c3c4f66

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 07:47

Target

2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe
Size

479KB
MD5

fa5f3c80627650b90c8466b703a0e944
SHA1

bc4c563c594ee4cec96f9dcfb44c47c97c409ed7
SHA256

e2438213b322537a94aa05a93a8a732aed075bd1a2ffaa083aef48138c3c4f66
SHA512

205f06ac16998202ce1b2f2cd6b28da7ff4084798ccd3d0d3ee8d4c8eadd8d423e3d6b99ac75cf823aa6544440f5fcd7620385a58b02dc59cda894e9a4e46a11
SSDEEP

12288:bO4rfItL8HAaV0zJx7My+jkT+CNhx975UO:bO4rQtGAaqJx7MycgvVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3700	326A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3700	326A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3700	3792	2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe	86
PID 3792 wrote to memory of 3700	3792	2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe	86
PID 3792 wrote to memory of 3700	3792	2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\326A.tmp
  "C:\Users\Admin\AppData\Local\Temp\326A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-05_fa5f3c80627650b90c8466b703a0e944_mafia.exe 779AD0D02258DE91F92562B2D5A30A88D3FE057C4DB4E9D61DF5C1605F89FA5710D4195458762829C10B744B279B7557A6C7EF701FAD6F5DA1B8B7C075E72D93
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3700

C:\Users\Admin\AppData\Local\Temp\326A.tmp

Filesize
479KB

MD5
efe3a22c4281e9913529ed4a6d902c58

SHA1
6822358c305b08ed932f28d54acb1d528d81afc5

SHA256
a2cbc4bccea5cfa74adcdeaa03ddd1c9f53b97f664dd32449c09e45ef8800f68

SHA512
de896179bea09207a72ac6796bd20e61f1123e97b7ae1547523b3961c0409b142ec3fdc4b2fb1a7f13124fc3753102bf56835aa19fedb9afff03e77d8c6c7a59

Download Submit