7b3e7392eb9b54bfe0df50e2dff40a604d0c58e0e5af09306dc7b4e23a1e1a66

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 04:36

Target

2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe
Size

433KB
MD5

445bcf7556cbafcb6fdf9c569063539d
SHA1

136f59c5909e7ab7c1be778f0e4e26bb534e8df3
SHA256

7b3e7392eb9b54bfe0df50e2dff40a604d0c58e0e5af09306dc7b4e23a1e1a66
SHA512

1635e11b6591cb1b914ec9aa5a7d71e7c0d64715a8ba82480662875fef1c7ce8451bda5189fd375793692e152acfa32374117450ba1789422b5f5167c856748a
SSDEEP

12288:Ci4g+yU+0pAiv+eaNzUDifg+PPK8tEYY2YlVn:Ci4gXn0pD+eaNh4mK8tExD3

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3448	1AC6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3448	1AC6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3448	1556	2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe	99
PID 1556 wrote to memory of 3448	1556	2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe	99
PID 1556 wrote to memory of 3448	1556	2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\1AC6.tmp
  "C:\Users\Admin\AppData\Local\Temp\1AC6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-16_445bcf7556cbafcb6fdf9c569063539d_mafia.exe 3A9ACCBB82F25986282AD3D1C39506F583BB2A0C4C5138A0D44E0D76375A266A682B3CBFA8E7B25CFFDECCFD68AD1AAC708358A66690A5431F5E60C5D2C1AB28
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\1AC6.tmp

Filesize
433KB

MD5
eaa6bdf2c5505dab331ed8934d7bf01d

SHA1
92b40897c25fd26a1f2fc7da2d1b266f39b44095

SHA256
b7125968f5fef2d33f58f7468b66ca4dc88485e22a5f154b112a448d75d30a0f

SHA512
7516994de9e370a6934f20038976ff30d86ad2cc2807006aeca002fc739e37067bd5222b4e6cf1bb5a8ca5406b4a4ae7ab09459c1a876cf243e3766f190451cf

Download Submit