076a2f2ffb38078819e626fb347409a0f7371fb390f8392f71c6b7da16a6c3e4

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 12:55

Target

2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe
Size

479KB
MD5

de4f64dedc4bf24b15947f3c25421f65
SHA1

a9bfb1c9635869c05ff66c3b85fb6d187018a60f
SHA256

076a2f2ffb38078819e626fb347409a0f7371fb390f8392f71c6b7da16a6c3e4
SHA512

23687cb2755ebe0a9231ac6d7c041f7282301ab0eaed44a76c4f4a26bc94b7097c656ddd8dd5b31a32fd09565809937070e39bbc8a8514f07262f80229700290
SSDEEP

6144:b9EyS4oMxIkjxcWqHtg88HARRryqcQegXoV6/6yaLupZuyF/t+Ql76HN+3N/V5dM:bO4rfItL8HATfegXV6FLwEowQlul75UO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
216	74E2.tmp

Executes dropped EXE 1 IoCs

pid	Process
216	74E2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 216	2948	2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe	95
PID 2948 wrote to memory of 216	2948	2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe	95
PID 2948 wrote to memory of 216	2948	2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\74E2.tmp
  "C:\Users\Admin\AppData\Local\Temp\74E2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-26_de4f64dedc4bf24b15947f3c25421f65_mafia.exe 4DC95014AAF7A23648E372F780DDF7124B47AC7EFACA055463FB530866109EA7415CE30C33BFF7F04B84843CF16229DEFA5D1E15FFAF47BD2E0C73683A1C9E2F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\74E2.tmp

Filesize
479KB

MD5
e759f911e0cb1fe0b1445c19cbf7bdef

SHA1
49fbc0bfaaa7841a2889442a3ba50f812681460e

SHA256
2ac4090e19f11817dd4c9ed53d4e483e714816a3e73623fd3a657cb4f77a4fd9

SHA512
55a1b4acc6acaa8bfefae1e8e6a47b87055f64d0eaf1d39e2f3060c083f053fdaeea7d2a1775af74a836153d8ee69ef295a012e9764c6b88195a21f31e274ec6

Download Submit