9f05a6bd6e07d2877d9acf02713fe8968cf556c8dd5ee46d3693e57ab69cf60e

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 14:43

Target

2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe
Size

443KB
MD5

c29f2d9a2ed4cb1baf746d1ffd288237
SHA1

10b471f79e998a3f27bc50df6860d11e52899d1a
SHA256

9f05a6bd6e07d2877d9acf02713fe8968cf556c8dd5ee46d3693e57ab69cf60e
SHA512

a9b2584d7f440c4aef6f37ab1afd18da906ca167e82862315c6f9c6ca538e4141b612277e3d60c8e082777623a64ea350b2827cff4898a55f20354f62227f406
SSDEEP

12288:Wq4w/ekieZgU662JafNY215lzcDunEJuVT0WWfgpYlMa:Wq4w/ekieH6xofNY21zcDuuIT0WWfrP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2964	EFFD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2964	EFFD.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2964	4516	2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe	96
PID 4516 wrote to memory of 2964	4516	2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe	96
PID 4516 wrote to memory of 2964	4516	2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\EFFD.tmp
  "C:\Users\Admin\AppData\Local\Temp\EFFD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-27_c29f2d9a2ed4cb1baf746d1ffd288237_mafia.exe 1E197D6DCE91C7C68673147479A5787B9FC20601604062E47B37C1D00772C802144746A96BF6D5A9F4BC11C8872929EC0EF2042D5A343F81EAD1659DD41155BA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:1972

C:\Users\Admin\AppData\Local\Temp\EFFD.tmp

Filesize
443KB

MD5
8afc0af9ff45278fec81024cc62b6553

SHA1
fb2d916cf636a8230824a5c774cae6c18b1481ca

SHA256
f56856ce2136671517ee8710cf45ebbf4a236e18fc15259fcd1b87c4b4358200

SHA512
500d377ca842ba26441dd705eb7bd38cfb45d4a120a2f1b22a2ee5a692785112e53cb924fe406e32f9ab4cdc45ceecfe8bfafcb50af5aea717f489c89e08f261

Download Submit