fcff911043092e3187b7e245d9a3ee3a3e1fcab47aa11c083634b375d505cd0e

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 17:30

Target

2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe
Size

476KB
MD5

33f40047ad4b06076569d2f5d8e530f0
SHA1

80e5aae188b2d50f9398069778e21816f9167366
SHA256

fcff911043092e3187b7e245d9a3ee3a3e1fcab47aa11c083634b375d505cd0e
SHA512

21d25ef7ee9443b599bff1bf2d3c5c2de2ed5802b37ec0debc6d426dfdae9044447496913eddc66ae45172208d475c50a1186b6876a5ace3e6583d2b8979848f
SSDEEP

12288:aO4rfItL8HRmb0BTMy/7AbqA/squR7K9wlsDpVFd:aO4rQtGR00DHd+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
560	3F17.tmp

Executes dropped EXE 1 IoCs

pid	Process
560	3F17.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 560	5584	2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe	97
PID 5584 wrote to memory of 560	5584	2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe	97
PID 5584 wrote to memory of 560	5584	2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Users\Admin\AppData\Local\Temp\3F17.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F17.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-15_33f40047ad4b06076569d2f5d8e530f0_mafia.exe 8170B6AC90C4190BF0B32CDA500CCADAC977B30A1EACA224B3CA9EDC23307EF10445C3FE1373C41921D54110F63B50561602289C3D479F7AB954D75B212DC10F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\3F17.tmp

Filesize
476KB

MD5
152a5b59b66c9cd044e8462072151bfa

SHA1
d08faa995d49bb46297dfb3255a07bfed21b33db

SHA256
b9f23a37d524f0a408c3e0e9b167b9b76e10f53ea3953dbf23932853890982de

SHA512
b0e2bd639320725040ad9e82d07e0eea2745539eaff809d47bd8c8ea818d9ec22aa1756d86ed9c209728d70c68f66e92560e070b53a9889822a0ecb7af922313

Download Submit