5a8bf0022290971f6a554147c4ac9e06d0984383fe27f921980816e2d1a45da7

Analysis

max time kernel
115s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 22:26

Target

2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe
Size

433KB
MD5

67aa2fa994ca4d6d91004c1b3343ae01
SHA1

8aa47c99be81539c78c0e80cb3a1e6d4fc7ef46b
SHA256

5a8bf0022290971f6a554147c4ac9e06d0984383fe27f921980816e2d1a45da7
SHA512

c8294dd76d88c021339b59599cee21ed336972705abea1324c51341f87b45cf642ca7818f71182f7b1396ab066f6fd5839b710563c0a755ae3c54e2035e3f3bc
SSDEEP

12288:Ci4g+yU+0pAiv+VvUxAZPt4zHVCOUUvUOg31p6tudn:Ci4gXn0pD+9UqZPK3fve6o

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4472	6DFC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4472	6DFC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4472	3316	2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe	96
PID 3316 wrote to memory of 4472	3316	2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe	96
PID 3316 wrote to memory of 4472	3316	2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\6DFC.tmp
  "C:\Users\Admin\AppData\Local\Temp\6DFC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_67aa2fa994ca4d6d91004c1b3343ae01_mafia.exe 18E5CE7A003D5E490E114E7C118A6CD9D035F11D9521CE908EEEC40D4C41E894BA000492DAD75DCB8FDC0D8B8DF1A1D73ACEAEA4FC46EECE2883EE10EF2233B6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:8
1⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\6DFC.tmp

Filesize
433KB

MD5
a10c100f502bfa8e7e97e267eb8e53e0

SHA1
346366b67d196223d65863b871604a3ed9035ce3

SHA256
a824037392473501ad3046e1445b5067a1cfcfdf82062fe3b49e9381a43f57c8

SHA512
1434ad90ad405827d8c4f834ae92481ea940172c478a3c8f0f02ab86a962bb3389a850b09ad3d705041ca0a922bb8c3202b330364e4d4f18c3b76d0c88e05fb5

Download Submit