e7dfa452ed1ef7b6d9affa57578fbb29e3a79479e553da514b4b1ab40448f95b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 02:48

Target

2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe
Size

443KB
MD5

9c90b57b3bc3af4b8a2666302461de57
SHA1

121b8f65f795a5153dd471d23909bc98a9619940
SHA256

e7dfa452ed1ef7b6d9affa57578fbb29e3a79479e553da514b4b1ab40448f95b
SHA512

5899a916eab2a5dd60618233f612722a23277eaa779da95dbbff0e48c31b01fb5b8c206b9b5b6341da55cc79fae8bd8bb7d79c57cb15369d455a1468a8c037f2
SSDEEP

12288:Wq4w/ekieZgU6tKxT0elfydIu/9uz+SclMa:Wq4w/ekieH6QxIelf0IC9u4P

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1912	8685.tmp

Executes dropped EXE 1 IoCs

pid	Process
1912	8685.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1912	1648	2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe	94
PID 1648 wrote to memory of 1912	1648	2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe	94
PID 1648 wrote to memory of 1912	1648	2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\8685.tmp
  "C:\Users\Admin\AppData\Local\Temp\8685.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-06_9c90b57b3bc3af4b8a2666302461de57_mafia.exe 2B8607AD2953582F4C49D2C010B3BC4552D5B9DEB5C4EB89A97ABCA014B7AA71F69BC36389671117F8BA2339EC04FCA0B4880DDB5763C93CCEBC30A9EF2D98EC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\8685.tmp

Filesize
443KB

MD5
b02f314c99a6b00eba371892e69220f6

SHA1
6a4a87efa999c7e4ff10ead771791cc00068af3a

SHA256
88a636a608b0ce2d556ae1e76d50120ceb473e2dc34b636e35fc3ceaa6e8e7f3

SHA512
65fab565bf673a6a5f0a52d7f5735b5116eb3d48581f492511583e1834b843954901b197871fadd25792e81e41c2a87b072928fea16c0e0799d53cca8f129a9f

Download Submit