ba0007498c76e1bef5f138c2ce0d9ea1e4dd80b83ff8ba1e9e551483fa9c3da8

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 00:27

Target

2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe
Size

486KB
MD5

1b90844def2814461f7adbe96b45b643
SHA1

bd3c8a49d7dc4f8de14d64931b5cc258522d66c6
SHA256

ba0007498c76e1bef5f138c2ce0d9ea1e4dd80b83ff8ba1e9e551483fa9c3da8
SHA512

4668ec0be022bc1452cb79d83fc334cc0bde6cab9c62b33e39a462823e0ef7321654aea3d1fdd73fd3e69343d0e6ceeb5ae04be0e8b36350835cd9730a7d83ae
SSDEEP

12288:3O4rfItL8HPzXplKwlNvBX8AEuYhmb/MrG7rKxUYXhW:3O4rQtGPz5lKwln8AErhP63KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
344	4C1C.tmp

Executes dropped EXE 1 IoCs

pid	Process
344	4C1C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 344	1596	2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe	87
PID 1596 wrote to memory of 344	1596	2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe	87
PID 1596 wrote to memory of 344	1596	2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\4C1C.tmp
  "C:\Users\Admin\AppData\Local\Temp\4C1C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_1b90844def2814461f7adbe96b45b643_mafia.exe B9806991F728DD585526253624AC06BAE95069637C4FE91FCD5DC3FEAF87FE5971929C65BF2330B6AF79C32A9232CBD9EE07AF65552BFD6DE180E582813E6D43
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:344

C:\Users\Admin\AppData\Local\Temp\4C1C.tmp

Filesize
486KB

MD5
dbbfc221963c005263ad648f2e621dff

SHA1
55ab24f918a5461fc050bd7696f901aada80f6d6

SHA256
5daa05534b8a017134303265c6af2c4baf526139061043b09948874012a7b0fd

SHA512
8adc0db2136be208387a44ced5394b3890b455d6c2afba656a2e40241c9426a1abd6947c2aaf509184b19c3cf2e3e834377290c2defe031dc6fb5f8acd4c48dc

Download Submit