2cb80e51da8d80fc692d7ac7279198e4261d84ea8a35282cb179903a3ccbbfca

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 00:45

Target

2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe
Size

433KB
MD5

787e619fa2904b3a3b4675b85fea3cf3
SHA1

d6c43c84491f0ec71d776ffc387964dd36747f47
SHA256

2cb80e51da8d80fc692d7ac7279198e4261d84ea8a35282cb179903a3ccbbfca
SHA512

7b1b700c83af226278e788c966b39f2c77f51b9afc00c5595d5d1da221ca2ef0e714e8a1aeb0a0fb994b7d9151bed091f14e9bff2e3117b0acaa3dc032f83f76
SSDEEP

12288:Ci4g+yU+0pAiv+tIR42BRoV+exskk/MsEy01qUn:Ci4gXn0pD+tI+hVFY/wyQq0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4128	321C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4128	321C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4128	2940	2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe	85
PID 2940 wrote to memory of 4128	2940	2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe	85
PID 2940 wrote to memory of 4128	2940	2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\321C.tmp
  "C:\Users\Admin\AppData\Local\Temp\321C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-06_787e619fa2904b3a3b4675b85fea3cf3_mafia.exe B56C03595623F2875A1DB767750E3A4C4ECF20EB09FE898649CE8B44E6A47B722F8A1EAA2D016CB3D5845DDE72D77D451549D9E1FA23920A674F1F95F9F5A75F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4128

C:\Users\Admin\AppData\Local\Temp\321C.tmp

Filesize
433KB

MD5
0d4801434938293d31e132d836b1d8a5

SHA1
16c99df28ae47710eace4db1b9f1ce525931a832

SHA256
fc3dc1f0fe04f21f9b6799f9ed9e0307d784205fe92a340e79847025b85985a2

SHA512
4b02369aa1d0d2e54491b1a6c9c7eb6645d22a9d8fd3d4f2d9dabfa6173ed2a68bfac2f1c17fcf27fb82baad6883e57af4fe5e1f97a2714d6086555becafcab3

Download Submit