5936601e67ff1fc37dc0ee9cc78b362563117a1bee534ff42613320fbfbc948e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 09:29

Target

2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe
Size

428KB
MD5

d0da6df7f56e7caf182d5ad4f13137d0
SHA1

627a9ed5afd2b0712e4f180d75c1c816feb33f24
SHA256

5936601e67ff1fc37dc0ee9cc78b362563117a1bee534ff42613320fbfbc948e
SHA512

b6f012e1e906b2af8d98dd01e43e6b62ebfc765d54e6858f25db1a0c9059859f6f2b0bf99d1363fdb767ef9db907343b55dd44cd14642677d8274f58e5ef8012
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFrSxfD5MJs3bnKkr0wgdLyOdIEeqHR:gZLolhNVyEx5JKg0/LyOdIVqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3664	516C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3664	516C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3664	4872	2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe	85
PID 4872 wrote to memory of 3664	4872	2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe	85
PID 4872 wrote to memory of 3664	4872	2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\516C.tmp
  "C:\Users\Admin\AppData\Local\Temp\516C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-20_d0da6df7f56e7caf182d5ad4f13137d0_mafia.exe 4729E72C3A9D1BAA6B55FFC6069F6B193BA3FEA50566494B9309351E0D2FDDD4178BE8137CFDCD295265DA9EFB179156CDDFD770996A5ADE733E1304BB6A4ACD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3664

C:\Users\Admin\AppData\Local\Temp\516C.tmp

Filesize
428KB

MD5
95ef674e931ddf41a42a764254a0f23c

SHA1
2f3e7965b58afccfab6cf8049f41c34feb7ee32c

SHA256
67a6e27b5459ec0058d7d3f9ca44d1e0aa2364a6a597a5b6921b6fc3df0b3e74

SHA512
7cd51839711622ea078d8bd2067bd335782524a711024c92768b7484235036bb732251fd5217fa4da8c349bf24fa6fb7a06da326c9e848be593599bd4a4c1649

Download Submit