825fe545a5fb13691cc0f928ab2698082f74a2a0e98307669df2ba3d2a9dd927

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 21:31

Target

2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe
Size

428KB
MD5

3a07c0da455d065ff481b823b00cfe82
SHA1

976f75327545028f4a7a9f61aa613b4a09068990
SHA256

825fe545a5fb13691cc0f928ab2698082f74a2a0e98307669df2ba3d2a9dd927
SHA512

a08f6c8602dafb18bf1d5867ce2212a6f6d9d0c78b35d00789307dc6ac1706e81d9ff7429aab168cbd886e97417cebe05afd582fb5920ed0c785a9473459f529
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFp3zWz+Lx9tYdeuSk8fZNuzyKD7z8zZqHR:gZLolhNVyERzg9So5Ljuz5OqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4968	3383.tmp

Executes dropped EXE 1 IoCs

pid	Process
4968	3383.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4968	1152	2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe	86
PID 1152 wrote to memory of 4968	1152	2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe	86
PID 1152 wrote to memory of 4968	1152	2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\3383.tmp
  "C:\Users\Admin\AppData\Local\Temp\3383.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-22_3a07c0da455d065ff481b823b00cfe82_mafia.exe 448E3CCA2C6B17A2DF3B8AACDE159631BD06B280AE1E96ADC7320BD77934B84FD5EDCD164A7B9EDE393E9C03FA961DC3FED8C969D3BAEF672D873ACA98830713
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4968

C:\Users\Admin\AppData\Local\Temp\3383.tmp

Filesize
428KB

MD5
a0a297cbf879d3835b371938614e7135

SHA1
3f0b1e1561df24c3aac04aec6fbfe4e19cff575a

SHA256
aa27f64e83cd3f12fca3fe36c0c95925b16bd54db8bf8efeb4fc0acf1054877b

SHA512
4a0acdafbe929924ac5432295d2f65a0e18fbcc3189a8504ec195ecf811ec1d45d953f678fcc645f12d4ebb8d64c116542846b37859cbad27ec74ef0595c1fc7

Download Submit