3fe89c697c73347787b11aa7f8d0a4318e6d0bced00dbf7f2b4a794562801358

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:27

Target

2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe
Size

428KB
MD5

33c973a798843de6edef322e4a530254
SHA1

7c3e15ca12677e86332240548013890818c53b15
SHA256

3fe89c697c73347787b11aa7f8d0a4318e6d0bced00dbf7f2b4a794562801358
SHA512

9f2e72605129508704b342dac89a685ba7fef2df672a7b5604e03e0838f4ab254069b55f3b17be7165ffcdc51d14480792d7ad756198605092ea6c4f543a81dc
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFbKvc/aRSG7lYWucXPz1zjL5PeHLhXHvbPWPqHR:gZLolhNVyEGKgT6lgc5k1HzPWPqHR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4908	1D57.tmp

Executes dropped EXE 1 IoCs

pid	Process
4908	1D57.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4908	4512	2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe	93
PID 4512 wrote to memory of 4908	4512	2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe	93
PID 4512 wrote to memory of 4908	4512	2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\1D57.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D57.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-04_33c973a798843de6edef322e4a530254_mafia.exe 2E36F547746F8A19AF8ECC3F0BA6E852A1DEFAF8CF77DAEFA83BAA2AD1CFDC479E09638C00D0B90A4369BE652A96BDD60C7D151D1A3029556A1D8E26E8B92745
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\1D57.tmp

Filesize
428KB

MD5
9fdcc375863ecb4a306f2793278cfca9

SHA1
ba74e86ac4acb16b18adf7b0e42ea597cdcf23bf

SHA256
d29acb2b6fae11ba3f54c3605a13b4eb81bf2f09ad04028b2252b5dddb2a879b

SHA512
566c1d4f31728f232e4d0003f4ec6331b1918369763c390db1872157e5dbd23e9437fdcb8be20042f4ae88dc02c29286c17b6af74644b58e5a542406225bddab

Download Submit