73d96340589018bfa31738051829b3a14c225456eae382a6d2658ec6acada5a9

Analysis

max time kernel
158s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 14:36

Target

2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
Size

486KB
MD5

b8c4dec165547797b48381d1bbc1ef01
SHA1

f2ec8892c07cac996f9286b1b9e55b8bc39cd54c
SHA256

73d96340589018bfa31738051829b3a14c225456eae382a6d2658ec6acada5a9
SHA512

21a5a1f28c96208eb2fa9536a5756ecc83d0972b95f8baac8e85099f50e2376a02566bfdc41124a7411416823f641e8a25849bd416b6e6afa5cd50cd68951178
SSDEEP

12288:3O4rfItL8HPkJScOSjY28oo/dcktMufK5t9b7rKxUYXhW:3O4rQtGPZwjYBPdvo53KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1020	606.tmp

Executes dropped EXE 1 IoCs

pid	Process
1020	606.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1020	2820	2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe	97
PID 2820 wrote to memory of 1020	2820	2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe	97
PID 2820 wrote to memory of 1020	2820	2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\606.tmp
  "C:\Users\Admin\AppData\Local\Temp\606.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe CAA377505B5195D9CCB27F0D8AC493E9913D17A09AAA58F489F940F31C5B02274EFEBA632775D6D7CB471BE33966B8E1A754F4F6A54844DA88C41F9F4F89F2CA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1156

C:\Users\Admin\AppData\Local\Temp\606.tmp

Filesize
486KB

MD5
427b74fd5cb8d37cd478f6f954ee1ba4

SHA1
2c2628e62dcd92c0b0ca1de6e63119285372891c

SHA256
1af16065d03fa2aedebd0b0b49736f46b1212fbf2b537945f1d86e7f456612c3

SHA512
eb8bc47f0e3a3fcf4c24370e172a335b8c41d79a0401df46e607a1c9acf7b5ecb538047ebdd030969dceaa7d210694a913e8b1f303c2bd1a70ba65f80c779be7

Download Submit