ab97645a99f2d05b95483c67bead813da87303dc81a86eadc988688ed6cf70bd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 01:30

Target

2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe
Size

384KB
MD5

e69073629899d7c356fc22a26dc7f055
SHA1

56623d26db5d93df2178a3fac2e34cba71b79d00
SHA256

ab97645a99f2d05b95483c67bead813da87303dc81a86eadc988688ed6cf70bd
SHA512

50b2bd3d453169be762a809de470f19b812dd55a4e4e0c70f4f4b5f2c1a25d43da39c1fd85cc484e3cd943202840687aa1436060faaf3138fe8220f66e088436
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHDJ7N1bxX0uQMdg0/a72x4ry+g28qCACNHuhZ:Zm48gODxbzrPlKMdtaCD+g28quNHuZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4508	2D4A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4508	2D4A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4508	4848	2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe	85
PID 4848 wrote to memory of 4508	4848	2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe	85
PID 4848 wrote to memory of 4508	4848	2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\2D4A.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D4A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-21_e69073629899d7c356fc22a26dc7f055_mafia.exe 220F32CF6B1C65E92235391B8D0CFD613624D34D64D1A21BEE5C4E2D9540534AD570B4906193AA4573E9266D8265A4AA4F21F4C4E86712C18EE58134BE0ADF7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4508

C:\Users\Admin\AppData\Local\Temp\2D4A.tmp

Filesize
384KB

MD5
ca769551b84e3d93979fc4cf5f4a5057

SHA1
16bb338a390e1e90ceeedd6917809ebd2d28b672

SHA256
1b593cb5fb79b208a60295827d4394cc82752b1ac4293ecaa98f5a89b0f399e3

SHA512
01f6feadbaebff9539f2244ad0f8cef572c1f59bf94f07f648bee2343958b74043d3b5241094f4a09c7e47c00afa0ff1cf5aa392a87e2c15ed570a30f84a4235

Download Submit