65ef5d40f5286f27654e89804e51e292efe8f9661fe7f4efe63e754b9f46c0a6

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:34

Target

2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe
Size

428KB
MD5

b5da472bdb0c804a43edb544695cabd2
SHA1

045fb48715c6768371c15bb0e761b45592f720fb
SHA256

65ef5d40f5286f27654e89804e51e292efe8f9661fe7f4efe63e754b9f46c0a6
SHA512

544c91d6bec7b32761e8bc22649f903d748f70ccaa3303ac4d180af9d440b67844e522ac37b05d1a185e41b299b982266665e312fb872716cad1923f20321980
SSDEEP

12288:Z594+AcL4tBekiuKzEr6CcyngVP8RtMygRf2oTJ9FQRmmiAkEl:BL4tBekiuVr6BJVxnRf7djE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
780	2C2C.tmp

Executes dropped EXE 1 IoCs

pid	Process
780	2C2C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 780	4696	2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe	96
PID 4696 wrote to memory of 780	4696	2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe	96
PID 4696 wrote to memory of 780	4696	2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\2C2C.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C2C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-04_b5da472bdb0c804a43edb544695cabd2_mafia.exe 61F2242AA6F3EB15400219DB5BA13B3C7A73D0502650D1F3AFBC58D0B6A4559243F2D656813689889FBD14143FEDA17F1B0DD32C0CCE638884900B2D339E0D90
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\2C2C.tmp

Filesize
428KB

MD5
2352dedd81330b9bac9dcbee618e5e57

SHA1
3a11e645cea209c6fca9c4068bfc0f9d28aac0d7

SHA256
b1340759143ca8fdc36dc45badbaaeffa2a0d485e79956430a3dfffbd2750885

SHA512
2ba027f682154296afae01fe7fc43dae810add6242a134f9446e4e0d1c1099a79f6ef43e888d9962b070eb2d99657e6c02f69d86f6ba479a5a43cab787614e59

Download Submit