f71323c8d2d9963760dbbd4eb11019910945418f86ce9ce402330b880ae1b0cb

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 23:29

Target

2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe
Size

448KB
MD5

7630a707f477c6df54c359147a8b48c4
SHA1

704fe50af68d59d7c0478ba25ad671bcdf39d5be
SHA256

f71323c8d2d9963760dbbd4eb11019910945418f86ce9ce402330b880ae1b0cb
SHA512

bfde5415e810b452134c24cf7363ddd9ccefe06ce2156968bb3e3dc504e96e51f432c6626c7828ac6dd2ef9bc1ea22dc4933bd5dc127840e2ea0508d403d6786
SSDEEP

6144:3FrJxvldL4c5ONK1tgRbd1s79+i5+MtqYAhIznPhgIEBfCOKmfW1F6RRgzAJn4cq:lb4bBxdi79LKxhI7Pd4qdn6Rm8Ns

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3132	2D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
3132	2D9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3132	4564	2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe	94
PID 4564 wrote to memory of 3132	4564	2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe	94
PID 4564 wrote to memory of 3132	4564	2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\2D9.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_7630a707f477c6df54c359147a8b48c4_mafia.exe 47F95B46498C8741E2447BDEF4CF1AA58EC301F27DA34331411E9769D133F38E685A66D5F7B0891EEC78EE91A102AC4BAB13651EBCEDE8D8124B53055708BE22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4476

C:\Users\Admin\AppData\Local\Temp\2D9.tmp

Filesize
448KB

MD5
c6929c0600bfce84378640aac0fb629c

SHA1
bcd06a2d69577be49cdfa1e52fe5929ac76f247b

SHA256
016d198b36f8937a76a0d0ef181c409457eb8a553918793b70b3cde2993594dd

SHA512
2ee106cbc9918e5ce96076a1fc6ecd548b4881aca56c88a510f4afd6cea0cc90e0a5f99e8604a2d4629c3a8f6156e8a7339a545896a6a579b960431f0bafc164

Download Submit
memory/3132-5-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3132-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4564-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4564-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download