d73c0a7e7350bb2a9f5fe02882ba5983df76b9ddbe5d5b0bb82cd01f967e1a13

Analysis

max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 18:22

Target

2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe
Size

441KB
MD5

a014140d4f5555e155f05e539268b141
SHA1

225e26e69cf584b3cb11abce5b9c841e660afa05
SHA256

d73c0a7e7350bb2a9f5fe02882ba5983df76b9ddbe5d5b0bb82cd01f967e1a13
SHA512

26933dd41cf3701a3d5dd7aa0b73e121590dafa80a63b339e6ddcc7d28b2c7761cc8f3beed79214f3f277a5cb2f6c1b66fb6208affc5448ed1b4d4e600221de0
SSDEEP

6144:6ajdz4s4mDHq9OXpOd0p6Jiv+vtvrNLgeeV6mXkqAd+qSesWYdz2xTRYJ9PIwmc:6i4ET7+0pAiv+0HXkPx1Kd9mc

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1516	2FAB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1516	2FAB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1516	2512	2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe	84
PID 2512 wrote to memory of 1516	2512	2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe	84
PID 2512 wrote to memory of 1516	2512	2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\2FAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\2FAB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-27_a014140d4f5555e155f05e539268b141_mafia.exe BD213ECCEA402104A5891ECA59FE31A0C3B41125497FE7B212C98140F40907A9ECA25917B4A254C0E6AA5210D53783DF3EAF3ABE93B03E76A0CE49C22E6ADC72
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1516

C:\Users\Admin\AppData\Local\Temp\2FAB.tmp

Filesize
441KB

MD5
3fbd6afad228e402bfc43befe8a4d5c3

SHA1
a609c9c539ee44aa507a6c2a3663e43aa0cf0a9e

SHA256
a9e575cd5e3998495b34d9930729a6cfd144206fc7829b215fc43f5cac50617d

SHA512
5e22aa159828281a25759b304e1cc9f58f9ca04b8bd2db40ecb9dbb36262a93e41f43c0b01ce6637f514f0d47c93533154716dfbf43d6d3a643e6042d4e8075a

Download Submit
memory/1516-6-0x0000000000B60000-0x0000000000BD7000-memory.dmp

Filesize
476KB

Download
memory/1516-7-0x0000000000B60000-0x0000000000BD7000-memory.dmp

Filesize
476KB

Download
memory/2512-0-0x0000000000D80000-0x0000000000DF7000-memory.dmp

Filesize
476KB

Download
memory/2512-4-0x0000000000D80000-0x0000000000DF7000-memory.dmp

Filesize
476KB

Download