97e8ddd074a01a91c23ee5bba598851ce275a4c5939a58e25df1262b923a54ba

Analysis

max time kernel
143s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 17:44

Target

2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe
Size

414KB
MD5

749f8d82d584b52173c961761fbc3141
SHA1

d7636840038e7c284fa0706bbbf500c9f0e83281
SHA256

97e8ddd074a01a91c23ee5bba598851ce275a4c5939a58e25df1262b923a54ba
SHA512

c487d5c1668deec0c5e32aa33e590eaa6e90326e9b7bd042aa3c6da7043a3aabfd234a0b191124ab8bdbf914b1790f61ae0213d7a8c6766529288cff2f30398d
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYyUrRiOjaL9C7I5tMzs65qpfjlH2TXM5UkN77zl:Wq4w/ekieZgU61Kikyv5mzS76GTl

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1612	20E1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1612	20E1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1612	2728	2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe	97
PID 2728 wrote to memory of 1612	2728	2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe	97
PID 2728 wrote to memory of 1612	2728	2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\20E1.tmp
  "C:\Users\Admin\AppData\Local\Temp\20E1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-06_749f8d82d584b52173c961761fbc3141_mafia.exe 01273B04C7CE0948B3164596C556FCA3C1D4BF0FAF88D63781C3CABF63073442B0F09688E027A88FA7BF9D7DA4206AB5B9659824195627E67EDD1BC121D21526
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:2224

C:\Users\Admin\AppData\Local\Temp\20E1.tmp

Filesize
64KB

MD5
c17aab0a96f6b0d6436d6a09e5818e2b

SHA1
0a781d33fd0140295567e68185c4b90a1db62c46

SHA256
6dcdb85eb8075f95f71307036af3e948f8bbecf0a6681e599f368185da3a5eda

SHA512
486d597c166e969684bea733efe43afe8d0bc6c5ed3ccae8bea775c21e4aa97a675013b435087d8d0e55668dfbfe20dee6eba64c0a9ff233b4b21a69685fe202

Download Submit
C:\Users\Admin\AppData\Local\Temp\20E1.tmp

Filesize
414KB

MD5
8f7315a09f2a65b27dbf742d4c91ba94

SHA1
fd768099d8c9597aa24671f841bf5c57da601a11

SHA256
ef93828c4a6a40479bb54ce364da55abbcb3a783c7d58d172b3c80d375b3852e

SHA512
cee788822e51029c362d9539e1cccafc2c34aa35cbd77d7de2532f571c700cb7482e2f3be32de6a3776912e85f8e0a40cfe027a141ede48089311ceba8ff009e

Download Submit