5ee31ca05e9df8aaa5a69abf8ca9ac3f8fe3c1165fc5c874aef5b8b0e63fcf81

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 16:37

Target

2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe
Size

448KB
MD5

8bb524f9438d47e7fd9f45bbd0e87f02
SHA1

81d9ff6de11954ccebb73060a21507b147cd2040
SHA256

5ee31ca05e9df8aaa5a69abf8ca9ac3f8fe3c1165fc5c874aef5b8b0e63fcf81
SHA512

fd41347b39828ade5903a51757f4cfcdcf1dab0d8852196c67e60ff1603eb96adf1aab820372bd5b1a60b0d2279b672a1e18d3aa89b51ee7ba2f7b681eb3ccec
SSDEEP

12288:lb4bBxdi79LLROno0jknyLMUhNmFMzpJMp+A4:lb4b7dkLLROnJuyLMUOFIkpI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2752	2EB1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2752	2EB1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2752	2744	2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe	87
PID 2744 wrote to memory of 2752	2744	2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe	87
PID 2744 wrote to memory of 2752	2744	2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\2EB1.tmp
  "C:\Users\Admin\AppData\Local\Temp\2EB1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-09_8bb524f9438d47e7fd9f45bbd0e87f02_mafia.exe E39F3C665083C08B61752110ACE8AF69726B3C817A990F43A716C32C936E48D6650AAE603E926A503C3A31852034659F023B2C56D3BA6BC93E84BC5D9B841AD5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2752

C:\Users\Admin\AppData\Local\Temp\2EB1.tmp

Filesize
448KB

MD5
d090626ab24209306bc6ce1a423f9c6c

SHA1
2917f2b0f0f61c2e14fdd59f9eff9489d372c318

SHA256
479465b6ff52602bfb4b30292ea748543a05667f945e65327eeffae80f1b9262

SHA512
224bd6e7e7234c351d09f5a91ff58e591a169aec9f553630ce34c8013ac09961833677738c87ec11f8cb0907b689e172479e1af8b84e5f0961d06168e6b8ae18

Download Submit
memory/2744-0-0x0000000000FA0000-0x0000000001019000-memory.dmp

Filesize
484KB

Download
memory/2744-5-0x0000000000FA0000-0x0000000001019000-memory.dmp

Filesize
484KB

Download
memory/2752-6-0x00000000008C0000-0x0000000000939000-memory.dmp

Filesize
484KB

Download
memory/2752-7-0x00000000008C0000-0x0000000000939000-memory.dmp

Filesize
484KB

Download