1aaa9dc81d380618290cb44f68be9279ba573992de4c9a9a5ba3fa35bfe2888c

Analysis

max time kernel
132s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 06:52

Target

2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe
Size

414KB
MD5

fa4e0fec8ef48739e267bc01cf6be424
SHA1

69ff855006d6806cde4f1be346c79b32d01c338d
SHA256

1aaa9dc81d380618290cb44f68be9279ba573992de4c9a9a5ba3fa35bfe2888c
SHA512

f8a0e92e79f01282d2c20d180c4e2a663f7a3367e04c68868407a1c23103ee9ad8f8e3569952f84b62a94a070ab0c55ba94ce51a7b6d2e44fe153e64a52e313a
SSDEEP

12288:Wq4w/ekieZgU67YPAtI4NXelanIeHxBmvTAcn:Wq4w/ekieH67qf4delsfRBmx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3688	569C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3688	569C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3688	1880	2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe	82
PID 1880 wrote to memory of 3688	1880	2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe	82
PID 1880 wrote to memory of 3688	1880	2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\569C.tmp
  "C:\Users\Admin\AppData\Local\Temp\569C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-05-26_fa4e0fec8ef48739e267bc01cf6be424_mafia.exe 6758F41CEB209900AC37CD9A7257CE082B0D41E47E6E04788534A8E871ABDDD3D26409ECE1F3C78B87D322B706EC5B86E48BC95629C9BAD5A562B2B52CB4E267
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3688

C:\Users\Admin\AppData\Local\Temp\569C.tmp

Filesize
414KB

MD5
9977a7604d9b2824b7cd1d0f4d1ef50b

SHA1
e6ac8772533e3fd9df6edd0f2b60b4a8ea1a7cea

SHA256
447a01bcac73681cc813601cafe9b6cd71f7effe83d5dac7cad70f38848d8dd5

SHA512
b3c5f1529399d99bb9513dff8bc6b77201c59aced3bf0870e67be8e78819a036d826dc67e17967f1e4204b7e1c9f0e47f05119a008e1828fa7fcdb29339c79e4

Download Submit