d9f9de8351c5975390d2bd394c7e11942d381dceace9a54fdb87cd46f2539d56

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 19:38

Target

2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe
Size

448KB
MD5

cf3a3c4159c0eed2a6f2066f8bdbbba5
SHA1

2bbe8c3865b386d59c7cf0ca931ace48c120a7a7
SHA256

d9f9de8351c5975390d2bd394c7e11942d381dceace9a54fdb87cd46f2539d56
SHA512

68e86bc619b32547e4a0038bf8eb6b3486a37f88d894138f55f13dfa3b8a4c143cfa9ec86a4e6ace9cb6433df79f65e63e9df833482c1a6ebd468690940a4001
SSDEEP

12288:lb4bBxdi79LVxFRf22MxQglBO+4/kljGOo:lb4b7dkLVxH+jQtGdGOo

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3304	38B3.tmp

Executes dropped EXE 1 IoCs

pid	Process
3304	38B3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3304	5100	2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe	85
PID 5100 wrote to memory of 3304	5100	2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe	85
PID 5100 wrote to memory of 3304	5100	2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\38B3.tmp
  "C:\Users\Admin\AppData\Local\Temp\38B3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_cf3a3c4159c0eed2a6f2066f8bdbbba5_mafia.exe 00DF3A899D8B28C50A28CC18A3AE2B4B9149A269A490747A47E3278875A9B9CDC1842CEB99C3EECA79ACCB25C9CEA2CFAC6C4ADAF5FB62FA493A23E495D5C5AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3304

C:\Users\Admin\AppData\Local\Temp\38B3.tmp

Filesize
448KB

MD5
169ca5b7cdc3b5a96cf57e40e3c23c01

SHA1
a932d06b2b5245cbacb0f874a500e5f42d6ff28d

SHA256
724020a68d7c68d7e0505c3005345ce97f5383a83d75275d6275323b8cd52864

SHA512
a82f1cce6a908aa0d28916bc022f61a435fb434f92f85cc80797a0d5cf851fb65830a998165963a6463ff9773e87c9e8cec0b3667ac7e7de2c8f1dfc992082de

Download Submit
memory/3304-4-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3304-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5100-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5100-5-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download