e10103673d4db000b1567fa6858feb2d6c4cc4b0676944d7820b0f2bdbf0d152

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 04:56

Target

2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe
Size

448KB
MD5

f31255f3fed517a17a9c5bb992f20412
SHA1

493865858a5206091c2351d4726b8d1ac63f2c67
SHA256

e10103673d4db000b1567fa6858feb2d6c4cc4b0676944d7820b0f2bdbf0d152
SHA512

5e3284d54165f9dc71d498146b1b9fcc377efce32e151a75ce7477da7ecc1372925064c480c3b2c6a44758fa23a99146156cebbb4340493cde1293669f71b66f
SSDEEP

12288:lb4bBxdi79Lhq0Rg99bHuy/vYHY0mqUyDc2BJP2B6A4:lb4b7dkLhBR8ts+qUyfJv

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2912	2E44.tmp

Executes dropped EXE 1 IoCs

pid	Process
2912	2E44.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2912	3868	2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe	86
PID 3868 wrote to memory of 2912	3868	2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe	86
PID 3868 wrote to memory of 2912	3868	2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\2E44.tmp
  "C:\Users\Admin\AppData\Local\Temp\2E44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_f31255f3fed517a17a9c5bb992f20412_mafia.exe 5DB7165AF8407EA54CFC18529EA526F6C41A471B963B124E75EA4C6E4DF26045F400343B13E829309D560E3ED6F4BE944341758099E4821F05F32EE68A130222
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2912

C:\Users\Admin\AppData\Local\Temp\2E44.tmp

Filesize
448KB

MD5
bf58390212f3603f9c44c96b7290424f

SHA1
01d3990cc091793993087bb85229ddb23299d161

SHA256
67719b0c86779ad51630ee78cb24d83a5160ae7d9518e2f70fbc2b9b513a3759

SHA512
4f3290e12c97c5e485789d0a3193655d0acedb3dc052c2dce0eba14f6a8218ff6990abf734baca09d477f705675d2d3e63b15395344dad8db1ccce9ca00fdc83

Download Submit
memory/2912-6-0x00000000009A0000-0x0000000000A19000-memory.dmp

Filesize
484KB

Download
memory/2912-7-0x00000000009A0000-0x0000000000A19000-memory.dmp

Filesize
484KB

Download
memory/3868-0-0x0000000000F20000-0x0000000000F99000-memory.dmp

Filesize
484KB

Download
memory/3868-5-0x0000000000F20000-0x0000000000F99000-memory.dmp

Filesize
484KB

Download