e1ef3329ec622d8c11b48e3959895bceeab19d7b3db556af1880d88b8ad7afdf

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 10:36

Target

2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe
Size

428KB
MD5

9308ed6fa4f6b25ece1144c0446ee23c
SHA1

9200a26d2f121a5052ef3e751b85e8b54583e487
SHA256

e1ef3329ec622d8c11b48e3959895bceeab19d7b3db556af1880d88b8ad7afdf
SHA512

3152bf32b1e0bfb63bf6a5f7e86ec5dee8d1cb14dab8a8eb33624610cead31f22ceac7d93c28904ccb35e77a7a848686a1c75fd791697644c740c43b0f9621ac
SSDEEP

12288:Z594+AcL4tBekiuKzErE+sqdBDa6z1mb8KyWiV+mIx8l:BL4tBekiuVrDsqdQSnKyFVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1232	6FC1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1232	6FC1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 1232	3228	2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe	87
PID 3228 wrote to memory of 1232	3228	2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe	87
PID 3228 wrote to memory of 1232	3228	2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\6FC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\6FC1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe A84BEA01F77DE4230FA381B6849275CC93699B998EC0D5AD3D858D85F44A1F62815137C42848428CC3096D7662ABE6BAFBF49D9C944E297F1C6468E7577570BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1232

C:\Users\Admin\AppData\Local\Temp\6FC1.tmp

Filesize
428KB

MD5
87b03cc8760b3cdd9fc7fb30cadc10c1

SHA1
d7a46e15f215d62fbdbdb818e27dee45dca15580

SHA256
0f22830c1cd84e31a1b14d65677a1a3deea46af690813da464899afdc27a57e6

SHA512
4e6d67974cb1a26ec1b7e11e772c8d04baa9daa00667c5312a41ccbc6f10028744ab4d25a6e6e90e1c1b210d09c38b3b9581f0aa67c3d648b9731424b9cd6c4f

Download Submit