91f78ca08cfc24a6ed31808b98fa3102731e628a6cd46c6eadc927c605fbebe5

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 21:28

Target

2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe
Size

443KB
MD5

1c6b47e19a7644a48c86bcaf268b99bd
SHA1

5416b1f2f79b1e2aa2aa4e97f4f2aec221cb6d44
SHA256

91f78ca08cfc24a6ed31808b98fa3102731e628a6cd46c6eadc927c605fbebe5
SHA512

e4091fc869c3cfd8bd811f828784a235caeb23c2b710ad9800383e6a53b497c133052d2d64b82b1cdccea540c0bbb310ddb74a848369c98181cef891b1eed909
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYlir1H7QKOEeM9S7GrVEznmUor040jN6n3KQlMa:Wq4w/ekieZgU6QZKL/SqyzxmyAaQlMa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3988	3488.tmp

Executes dropped EXE 1 IoCs

pid	Process
3988	3488.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3988	760	2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe	98
PID 760 wrote to memory of 3988	760	2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe	98
PID 760 wrote to memory of 3988	760	2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\3488.tmp
  "C:\Users\Admin\AppData\Local\Temp\3488.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-05_1c6b47e19a7644a48c86bcaf268b99bd_mafia.exe ED3664DA888F9A9F36E0E05400F5C1A3315B1AA8EDD4E0C4D2467A554285A5FF1CCB818D18270FFDF7110979625D975E9AD391EDB87C1E1DB9AE236192CA79BB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\3488.tmp

Filesize
443KB

MD5
87880c379dd53d48a6e4b801c434eb2c

SHA1
cc5249e155482d47d83f6ed726aef21562f9d0bb

SHA256
6713c156e032e60fddc90349f767b35eadd53ded28de6bd93a8f7e6e66d568bf

SHA512
3992d3f366cbc488b23e9ae098264aa215af8bf89d86d61ede73ee0c44f642b432a5ab72f175e304761030fed40357aef55fc12f1334db462331a60f28ce00c1

Download Submit