47cf08b122c9c43b25ed4d7c0050a413eb7ecfb956b63c291fe1e0f87af10592

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 05:51

Target

2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe
Size

476KB
MD5

de1d7aed82e158a1c9085d9cfa79c967
SHA1

0464b3f3687d7161bc33f52ef59ce821415e7c1c
SHA256

47cf08b122c9c43b25ed4d7c0050a413eb7ecfb956b63c291fe1e0f87af10592
SHA512

eb7e80a23b06f38ef6dc7de3e4078ecb9b6b422e155fa58d3983daff0af05a155de4367196ca9d614cb08bb5c875d35478ec7ea200926b632598bf62f475411c
SSDEEP

12288:aO4rfItL8HRuHRLKmi4Zwe785Yr085GDI5+8gJpXew7K9wlsDpVFd:aO4rQtGRIwe785YpiIKL+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3052	59C8.tmp

Executes dropped EXE 1 IoCs

pid	Process
3052	59C8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 3052	492	2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe	91
PID 492 wrote to memory of 3052	492	2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe	91
PID 492 wrote to memory of 3052	492	2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\59C8.tmp
  "C:\Users\Admin\AppData\Local\Temp\59C8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-05_de1d7aed82e158a1c9085d9cfa79c967_mafia.exe 661E6EF07F6B0AE43EC71727E07309CB636ADED76916A7E82AE2D0B11167649A9925ABC2C478A1F7557B4855A543926470E4A7B6D780826889CF9DD658289798
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3660 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:3032

C:\Users\Admin\AppData\Local\Temp\59C8.tmp

Filesize
476KB

MD5
4783a7da12a473af022faf399eb2e822

SHA1
9bbe793a3526ef8794afe8ed9fc0001a4aaffb97

SHA256
0133fe7def32fa90d15facef45885d6a994c1943f8203c11bf4586e0673c6dad

SHA512
ee93a5610b63f4f528e0bfc87c43f849ccc2364e6926e65426b726537661b368851abb9615d1fb3946342315df93ef91b231d46138492ed6d80c024c26b37370

Download Submit