ecc4ed95c394cab88739227bfeac27100f18a6a6d3baf64124ed13d3b4efe3a0

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 04:50

Target

2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe
Size

428KB
MD5

91051923a4defd388a334b617188e8c9
SHA1

7320f9d84f8262aa73ef5b1682327e74d35a3bcc
SHA256

ecc4ed95c394cab88739227bfeac27100f18a6a6d3baf64124ed13d3b4efe3a0
SHA512

f56b78a5c6f5776e009da509a655281e739834c5c989796d1d5a6f9b4e5d165c0fe1adf58347bfdb982db2eacbbadad9f3f0f59e7f8e6a9b61b7e67caddace7c
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mF4NoQH88lRnapnfgUSC/bxGkb8W6o75RukG6qHR:gZLolhNVyEJNNH80S43Obo8f6KA36qHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4048	AC9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4048	AC9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4048	4900	2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe	97
PID 4900 wrote to memory of 4048	4900	2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe	97
PID 4900 wrote to memory of 4048	4900	2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\AC9.tmp
  "C:\Users\Admin\AppData\Local\Temp\AC9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-16_91051923a4defd388a334b617188e8c9_mafia.exe A5F40EDE5BE15C1E219DDECF8F05628AA9C319CADD4EB216172CA34DF555F87FB1E306B5DBB5922D2975EA177C3386D69B0F5AF2E3CBEA7BB61BA89F9F1EB82B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3896

C:\Users\Admin\AppData\Local\Temp\AC9.tmp

Filesize
428KB

MD5
d02ae8d32689afcb040006c5a518ed74

SHA1
f14285cf0aa851c95f0f7a673638b5a4860fd589

SHA256
08b4770907750346a02701bbea93c43ce8a80939fda7fefe0ff879c59e40acb4

SHA512
90b05d819797e2efad893edc8b0883f221f7f3eb8c64cd1445dfb7f3a9150d2e9c32abf4a2757686857d2cbd51151abd1b00bbbebae6e818d83e1b8f26cd0e69

Download Submit