2f9a49e1e8c1b172d6772b08b5a58b4531d874db152ffce2286a53a19db9466e

Analysis

max time kernel
155s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 00:25

Target

2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe
Size

414KB
MD5

08b29e7688838ebeb98c07aaadb35bb1
SHA1

b73cb5bd6dca55ae8289a7b36a045e8268339dd1
SHA256

2f9a49e1e8c1b172d6772b08b5a58b4531d874db152ffce2286a53a19db9466e
SHA512

48d22b21d19d4c64b4b620a052c092b17b011df3b273b8a2d72503b83c3756c293061e96d30a5f6f5d1bb472c363f05d1881fb94b1530525ed3e83cd472c8e67
SSDEEP

12288:Wq4w/ekieZgU6YVXnW/U2Ass+rvRZ2Dlx:Wq4w/ekieH6QnxFsz2Dr

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4208	26CD.tmp

Executes dropped EXE 1 IoCs

pid	Process
4208	26CD.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4208	5040	2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe	100
PID 5040 wrote to memory of 4208	5040	2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe	100
PID 5040 wrote to memory of 4208	5040	2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe	100

C:\Users\Admin\AppData\Local\Temp\2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\26CD.tmp
  "C:\Users\Admin\AppData\Local\Temp\26CD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-07_08b29e7688838ebeb98c07aaadb35bb1_mafia.exe C69492FD24F85DD32F78A3E32FD24CC93595643D3043FC93B5BBBDC4D60EDB11D609649D8A69E1E32AD50ABF96C6473CC240EAD18BC4ABA3CA227ECD6AD28ECC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4012

C:\Users\Admin\AppData\Local\Temp\26CD.tmp

Filesize
414KB

MD5
ecfbfa43a8b64729958b9709a4195d74

SHA1
f234e291b891e86c7a9c3a41d01d7bdc5c7498d1

SHA256
a2f1423dcd87fe65a619fbffe1bb3dbdf20691fef8dbde2d15878ebbe4005303

SHA512
28359e80a4c52ceabebfc333b8940e5d0853a7651a6d0f7522ccb72309634ff99dcba00005354d55d46a87a936e6f48e8168836b5cc342f72ea4c760b9886933

Download Submit