bff839363161d20d8dfe8c85642fc609b649f7680299a4990e1cbc5668e29200

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 08:29

Target

2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe
Size

435KB
MD5

6093fd1b9f19eea407d70476793dfe5a
SHA1

a03cc4eab9e2ce779ac1d0015df5d28364b84065
SHA256

bff839363161d20d8dfe8c85642fc609b649f7680299a4990e1cbc5668e29200
SHA512

dc5245f0dd3002a4ce5c1ec37548d75fd5c343c5df3ed0cf9dcdf8e85c812068d8e8cc1f6f1ab36993f5b94743ea3d76d74b2082f9d4ef5491b4557a0806cf31
SSDEEP

12288:9W4ufepiqKQ1mJyk/FKWlnb7P9zujSRSXJ:9W4ufepiqhmJySplb7PkaSX

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2324	5072.tmp

Executes dropped EXE 1 IoCs

pid	Process
2324	5072.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2324	228	2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe	84
PID 228 wrote to memory of 2324	228	2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe	84
PID 228 wrote to memory of 2324	228	2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\5072.tmp
  "C:\Users\Admin\AppData\Local\Temp\5072.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-18_6093fd1b9f19eea407d70476793dfe5a_mafia.exe A535A1D8B3D37400689DA020F8DB459D9B75D20128DC7410E8E84FE5C35B5C4FF52DB82A1DF4CEE28B4D584F0DE39A664B51574A59FE1D7DE50A80102BBC390D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2324

C:\Users\Admin\AppData\Local\Temp\5072.tmp

Filesize
435KB

MD5
cf95f51b0f2ef9a84640a3cd097c4aa4

SHA1
3e3d61c99828a379c48fefd9013fe9088c578846

SHA256
31ccd6961c5f13d9d101671ac31be0f622077e9ed9ce0396a38765f6d88df47a

SHA512
29ed93c2aca0dcd88f5e25e1f3443dcd9587c690780d56ebfbf7e84747632e75698ea426ee90d35d894597d31988487b097fc8b82c6a8a5ec5dc1e5b46513376

Download Submit