12938fb34442871b60853de3afe7d034b6fa086dcfd086fd87e022ba3589bd29

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 08:34

Target

2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe
Size

384KB
MD5

4024d88bf72fc20f7575bf97c5c59382
SHA1

7eabfcdc09e75be5f5c1560f87b3f0616554c7f1
SHA256

12938fb34442871b60853de3afe7d034b6fa086dcfd086fd87e022ba3589bd29
SHA512

faf79319f3f2a02a61ba2c4de910347c8c2a9f1c1db33c545429c2f83128132cbdb308535c18d53d33afeedc40be17bef04817c10e269d08636b983292c5ebae
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH1+Ehr7kqnaEDvP1Wv1laHqDN8SZ:Zm48gODxbzSEhvkqjP8vTVRZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2200	420A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2200	420A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2200	3816	2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe	85
PID 3816 wrote to memory of 2200	3816	2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe	85
PID 3816 wrote to memory of 2200	3816	2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\420A.tmp
  "C:\Users\Admin\AppData\Local\Temp\420A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe 8AFCDE90A397A98295D91089283027C69AB0EF7267B2A4E7D5A7149BF40FBDAA1DDD6825223FE4FA8BDB0661F58AE5D2C5F4EB5D87EFF12C6E88897CED57BF40
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2200

C:\Users\Admin\AppData\Local\Temp\420A.tmp

Filesize
384KB

MD5
e0483b7750c901c8e8765e0d3ca09b97

SHA1
75019c5c6515bcca92de563cd973f75d3caf5d8e

SHA256
55fd64335f59af2cd9ffded2695aa2e2f88b8436ccf02bd16e7ccfcb9f86d4e0

SHA512
2d367b7e6fb66ae175d224ae99ea2bfba0b745a172b6c0ea63a2a7d076b555e0eba097c55c4d983052153eb7849c05654180ee9cfafeb66d7ab65c7b9e5a5557

Download Submit