c3b81962b5011e63fbe89bae51677f5d86e303da341010feba36f740f305a5c4

Analysis

max time kernel
116s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 16:08

Target

2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe
Size

486KB
MD5

df300491c8fd545c36f1945568db1945
SHA1

4707b963038372f61092643cdb0d234015cfb444
SHA256

c3b81962b5011e63fbe89bae51677f5d86e303da341010feba36f740f305a5c4
SHA512

ba8e10031773cb1a8502a732ff377889dc0439961274e4258892b4512411cc531a56c0764f55125e992e0a3a98c56e56991c173028555b3a95837456d470421b
SSDEEP

12288:3O4rfItL8HPJq4XsL1kcyDkknJNk+ex0VllZgK7rKxUYXhW:3O4rQtGPJqVkcyLJNk+eiWK3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4924	7BF6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4924	7BF6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4924	4024	2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe	96
PID 4024 wrote to memory of 4924	4024	2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe	96
PID 4024 wrote to memory of 4924	4024	2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Users\Admin\AppData\Local\Temp\7BF6.tmp
  "C:\Users\Admin\AppData\Local\Temp\7BF6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_df300491c8fd545c36f1945568db1945_mafia.exe 1EEBBB5C0158721334D117FE163853B7843A8BED3902685585B99FF239E197370E3A21C893CA3320CFC6E22EEFD0CE0FBF1D26C6FF8567D975E9D017AEF88F9E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\7BF6.tmp

Filesize
486KB

MD5
96cfd14f8011df808c52f12ddb423e17

SHA1
98b381468d52891fd97463dac8c2ee3d14e63bd1

SHA256
456f31dcd31e9196b8b27813ffe7518b9ebdec771e5dbe5e1c33fe5cfe46fb58

SHA512
ce832975e1f55aedc644763070e24da5add109f72612edaef6649079472df79ac789286e6d4ca284a3d6a233d0f76c102f32f8d406281d4261e77e2c20cfcfb4

Download Submit