82025b8e7358eae1d4b18c1edeb8784793c2b3581472002318b309e4a382d493

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 08:44

Target

2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe
Size

486KB
MD5

7bbbcbedc1836afbf9d6d8dd381cdc04
SHA1

1e17d9845ef2485544bdbb3351189fc4d3be278d
SHA256

82025b8e7358eae1d4b18c1edeb8784793c2b3581472002318b309e4a382d493
SHA512

e0e9a06965cec1bad1e00f3b0377ae54a4105169d0b78d5c2d228483b73e62a92ba0cc3ead1a20c311dc8dfb834899835d4c5bc21d50f2568a5a65f03ce2f761
SSDEEP

12288:3O4rfItL8HPy8AeaCvdoSHnUDEMzoSPOQ7+7rKxUYXhW:3O4rQtGPuQySHUDEyoSPpy3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4772	737A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4772	737A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4772	2928	2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe	83
PID 2928 wrote to memory of 4772	2928	2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe	83
PID 2928 wrote to memory of 4772	2928	2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\737A.tmp
  "C:\Users\Admin\AppData\Local\Temp\737A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-11_7bbbcbedc1836afbf9d6d8dd381cdc04_mafia.exe A5519608B80D48554B645E4C0DA679CAC22A372DF818C3836734869951E5645EDCE7427425896EA5EEFFBBED6310377B96826466E3B9231C1CC17184D54D463B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4772

C:\Users\Admin\AppData\Local\Temp\737A.tmp

Filesize
486KB

MD5
14d7009cf007e12b93b9a01669f319c0

SHA1
0f0b5c732d945d60deea29f7fe463232e13a6c76

SHA256
d9e3803a385a17d4e2648e5a21c73f3aa7682b189cbd39de49910d008bed44dc

SHA512
bbe8ccfeb5ce4aae430e98cff80ae05b6e53d1a8fc53d4f5aa6566e11c921a874debc0fb93b021a11fb674937cdbdedff4a6596d1fa223ef40a5c8997c841297

Download Submit