7336ab208327e3fda5abb799533daf5bf6e23a902493a8855d10a58ae09f8986

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 01:48

Target

2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe
Size

468KB
MD5

3b3bfbd877f6e1a511f76f3af27e40fd
SHA1

bd3faf173c7f8bdc9d8aeab055f66d83a824b635
SHA256

7336ab208327e3fda5abb799533daf5bf6e23a902493a8855d10a58ae09f8986
SHA512

ed5da048e356355ea4c762be21805a15891dbb630e4f86b791a29da30df629d228fb212d2d9b821adf642a2932f5db09d1735d487c6f7c8d589b3e2365762731
SSDEEP

12288:qO4rfItL8HGAdA56D8xZK3DHBoi7bWmeEVGL:qO4rQtGGAi5y31oiumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3484	142F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3484	142F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3484	4816	2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe	99
PID 4816 wrote to memory of 3484	4816	2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe	99
PID 4816 wrote to memory of 3484	4816	2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\142F.tmp
  "C:\Users\Admin\AppData\Local\Temp\142F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-19_3b3bfbd877f6e1a511f76f3af27e40fd_mafia.exe 55BD6D78C83FBD02FBC33EACEDB610494002CFE9252FEA29A5557ACBAC98F25D602E391E7362BF890A742FFE857C9DABFAE4151D36E0008548349AC81F00657C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\142F.tmp

Filesize
468KB

MD5
c191c743b15445edb6f8985a7ce7bfd4

SHA1
66145d89bd48aad244c6935070b63a7e956c882e

SHA256
4d8e36e6061c508b7702a99e7bac0ead34e96274fa1f5339c5b278d3cad1dc7d

SHA512
46bd33225a2b039b6b41bd8ca659d2d157737f3598597b3a62aa60db4f699ffb08a72975e38a78599b252e9e42def09f1e92cfe981c052dfc3e0d2695e4073fd

Download Submit