63defe2cbd2c4c2ce08e4498b800578519a59ca7bda60c74cc23382900090d5f

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 15:48

Target

2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe
Size

384KB
MD5

97d35b5b886ebf1aaf22eb4fffe98d54
SHA1

3149f37772ea73d2410ee0a6961044347c6313f4
SHA256

63defe2cbd2c4c2ce08e4498b800578519a59ca7bda60c74cc23382900090d5f
SHA512

51634bd9420a304dbd29e4aca61b1447da1f8f3c67654e181139447c22c96a40981017e0b0ffcb7e25edeffcdd6c26a7f6add151f74887e6f57e38aaf99a114e
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHwCuPJrjqRZIyMecc3otCJeKGh6ZKPrYOLnFzLxW:Zm48gODxbzez+mDeotC87kOLnVx9MRZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3728	6A91.tmp

Executes dropped EXE 1 IoCs

pid	Process
3728	6A91.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3728	4640	2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe	97
PID 4640 wrote to memory of 3728	4640	2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe	97
PID 4640 wrote to memory of 3728	4640	2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\6A91.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A91.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-27_97d35b5b886ebf1aaf22eb4fffe98d54_mafia.exe CDF4A821AB78920B62F28870BBA43E5336193924998C846A1BB3945816BEF6EC64D2BD3E6AE38A4FF956549A2B96632A1D6243A5D53E46D7BCB7D5527A795FC6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\6A91.tmp

Filesize
384KB

MD5
87b9a9c348befd88b63511e90950c4d8

SHA1
772942b38d9f2e2dac8b7f59f20183691acad2a5

SHA256
0f7834ed4914a307eb958c5c96e4bd1ac3aeb0024b64f92329a055f118f05e4f

SHA512
efa0814756f1db0d9274327da53be43f17fb07a2878faa5d4439e8acdfa928bc5fc407c70d8cc45295c6b4b5f6d0eb6c68116bc2208c4076eff5c91ff274780f

Download Submit