55558d50a47a51a5823f6a3718d92c9b3749fcc62f05c9d028d22ee421363877

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 07:45

Target

2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe
Size

479KB
MD5

5942edd8b748421ccba3b2c41e2ffe6e
SHA1

5d3238c110e903ccce33d3709564723e3253a876
SHA256

55558d50a47a51a5823f6a3718d92c9b3749fcc62f05c9d028d22ee421363877
SHA512

de1d125beae15fe96422a15dcb0688a370c3f763398a875cf804f3008cd040a022d20ca55bbc70cb94a6e3194eb38df1e8616f97d7854a359afb152f3819d505
SSDEEP

12288:bO4rfItL8HASDIeMI6QwcGWYxzE/yY0/xm75UO:bO4rQtGAC8QwGYxzE65mVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2900	5340.tmp

Executes dropped EXE 1 IoCs

pid	Process
2900	5340.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2900	1552	2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe	85
PID 1552 wrote to memory of 2900	1552	2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe	85
PID 1552 wrote to memory of 2900	1552	2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\5340.tmp
  "C:\Users\Admin\AppData\Local\Temp\5340.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-22_5942edd8b748421ccba3b2c41e2ffe6e_mafia.exe C1BBA7E8FB0F669CEC242A48E0FE73ABDBAB0CE8E75787D4B3A584A0B4A32A7937586CE34259B3AFD87E938F7D85E9B5FFA5C292F3456F8607FAF3C5F48F3F2A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2900

C:\Users\Admin\AppData\Local\Temp\5340.tmp

Filesize
479KB

MD5
94d45b0d9dc38d7860db14eb04c2f950

SHA1
c6d452fa9a3bfd812731a6eca5278d6cf1024e74

SHA256
a54f872d0defed5a8a7cb4d2d90d4f202b67528caf504b8f8294cbf2e638bcfc

SHA512
05f2200de20f45a7b3401ef88b64e34e4174e116022c63e96f798f94dfb1ee1ec13d53bc34cdbdf9d52211d37efdee93f5c3e11cd563009a49b8a60b231eb56f

Download Submit