fbd28fa3a89c6f2003869afe99670cb6c9946bec670fdfd5616c566e006a2301

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 07:31

Target

2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe
Size

443KB
MD5

63f8c91ea61bc83f19453287ace46e39
SHA1

729b2a8c8e370e5ac3dfe02e497287b1033823bd
SHA256

fbd28fa3a89c6f2003869afe99670cb6c9946bec670fdfd5616c566e006a2301
SHA512

137dfdfd17ff1e9102c22019dc38e3cacf3e775d9e0c0c030bb6afad7de44603deb614b2e2508d6759ace4d4b1758c9ebfb2c37c863db227a9519060df251f92
SSDEEP

12288:Wq4w/ekieZgU6SG53jx4evc6NMRI1tvE/lMa:Wq4w/ekieH6SG5z7c6prvUP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
536	6409.tmp

Executes dropped EXE 1 IoCs

pid	Process
536	6409.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 536	3004	2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe	87
PID 3004 wrote to memory of 536	3004	2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe	87
PID 3004 wrote to memory of 536	3004	2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\6409.tmp
  "C:\Users\Admin\AppData\Local\Temp\6409.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_63f8c91ea61bc83f19453287ace46e39_mafia.exe C480E07ACBBA9551C94AB142D0431283667DA8059DD8CE27E80C77D1FA3C01EFC002BECBAE5C510F139CAEE6BD35DE8C312DD9BA1732D1E6CB61B7CF206C69DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:536

C:\Users\Admin\AppData\Local\Temp\6409.tmp

Filesize
443KB

MD5
66e329fff58aeb5def986d1594dad179

SHA1
e5eef24cd1b95e91dfdff47b272a96d731e4766b

SHA256
c2d63e1f7d8ff863d7c2f0b278d5a13325470dd1da725cf6c52229c18b36c04c

SHA512
0e52bc6f0b35b004e945828f48ff4d1520d3cc1cf62ce498b0f0da8d0b2b0c6cc0abac983131bf93b0deddccd95978d14c53953161df48fa2db27c418add02e7

Download Submit