d610c4cba7280c6ed43d4a55490528b7becc1e74bae99dd3407bd617477c38d6

Analysis

max time kernel
127s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 21:26

Target

2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe
Size

444KB
MD5

338088517fea4a2569b38145a69e4856
SHA1

1b0d035182150612cb37e4f8f04d0411e5c0dfff
SHA256

d610c4cba7280c6ed43d4a55490528b7becc1e74bae99dd3407bd617477c38d6
SHA512

30b821aa8b8852d7382ae754c5067963027e945d8617ad7fd60e75a06af6a48d58396ab096ab20963f14fd19c99bee0a47b99917757e50d55d3445dd88380e89
SSDEEP

12288:Nb4bZudi79LtgKap0EhWqHbJxScCP/Q/+X24yA:Nb4bcdkLq/p06WabJx8/9X24

Score

7^/10

Deletes itself 1 IoCs

pid	Process
980	80E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
980	80E8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 980	228	2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe	94
PID 228 wrote to memory of 980	228	2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe	94
PID 228 wrote to memory of 980	228	2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\80E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\80E8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-27_338088517fea4a2569b38145a69e4856_mafia.exe 8746E5B5B1A904900338C5E9D81CA2A366965BF108866C25960DB0C1D6B2891DD35AF0DD069D4F5C10D098091816023EC19C653C8C49E5ED7B507500081CCF9C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:8
1⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\80E8.tmp

Filesize
444KB

MD5
57dc06969db630bfd4eff988614e18bc

SHA1
390e5d5c980204a73da271ca9acae9a9e496f118

SHA256
333f37ba3d7555efdc685bca53d0c4ad00a207c5a93464c85a353115c31cbfbf

SHA512
e683b5e1f713967fd96fc5a4e87862677d93ace5dbbfea6a27ff10210c876d958efc40238abe4f9628be12a4bce4b84ce4c55e4c16ffb9c6152b097c6c8e8d6e

Download Submit