4efa71bd70ea818386e28ae09a5ab8f0662d226965a8241ddaab7cef34f04865

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 03:45

Target

2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe
Size

411KB
MD5

8851098485b1f0c17b8a0ed9af99cc19
SHA1

dfeb5f836a9456306e16747eb62337b6013a4028
SHA256

4efa71bd70ea818386e28ae09a5ab8f0662d226965a8241ddaab7cef34f04865
SHA512

8320a94a7bac8c3f508c4111edecbd4c82f7ab87ba8239d25a08e69ffcd98bf397dd0ed3f5eb3f6e626b249842262c130873fb7d6a9ca119ae771d84e7561b2b
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFG5/Sb56/c+ZBxjJq02NEYJE/SrWqHI:gZLolhNVyE/6b5B+ZBOZEP/SKqHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1900	2556.tmp

Executes dropped EXE 1 IoCs

pid	Process
1900	2556.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1900	1520	2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe	96
PID 1520 wrote to memory of 1900	1520	2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe	96
PID 1520 wrote to memory of 1900	1520	2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\2556.tmp
  "C:\Users\Admin\AppData\Local\Temp\2556.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-08_8851098485b1f0c17b8a0ed9af99cc19_mafia.exe 930A3E83B20BB2F0BC57605C524E9CC40CD4863442E6A8DF82A801EFDC20CD71D0B5DCC18ED6771B196981E6ED9BEA56C642C4756B35B5701AE4510E9A9FAD17
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\2556.tmp

Filesize
411KB

MD5
770ae5b5e72bb295368c05c5add1af8a

SHA1
a8c75c80adb28ec617cce54e85f0d7fd8df6ddd1

SHA256
f0615daf858bb5d83758a9433fd94e38e02e02f942397abb50a83b01b1a58369

SHA512
8e0ed79a43f9456480d8b237d83f0c438ee76c6ba59a4f8ff6390c068a73301fc9902c2578cb9833fd01ed014803e2e65cb467d5f78f562a90094866f9116bcc

Download Submit