b548f0fefb72d82c935b9f79a8f9b2e654521ba910bcd1e132ebc0c520863ab4

Analysis

max time kernel
115s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 22:41

Target

2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe
Size

428KB
MD5

005d5d680cdf1ac98607d2c31d0e494f
SHA1

20667c17936c7d7e59fab55f3574488574e15ad1
SHA256

b548f0fefb72d82c935b9f79a8f9b2e654521ba910bcd1e132ebc0c520863ab4
SHA512

8e490f3ecb74ff79f4da3eee7ec1e71b61417e1a26c550316c194664720336bd619802440466eedb05bc59e1078b71219e4d5c3b35a7d33399f67debca116928
SSDEEP

12288:Z594+AcL4tBekiuKzErboNafLF+Az6xG4MFjl:BL4tBekiuVr0NeLFf4GJR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3588	7EB5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3588	7EB5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3588	4736	2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe	94
PID 4736 wrote to memory of 3588	4736	2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe	94
PID 4736 wrote to memory of 3588	4736	2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\7EB5.tmp
  "C:\Users\Admin\AppData\Local\Temp\7EB5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-08_005d5d680cdf1ac98607d2c31d0e494f_mafia.exe CBE3190CF10EA6E513EF31A36BAF2E5A86721C0516096A9D3C1E96FDCD69A7A6B615FCD458A5C53A0E4BDC0720E8EBECE7CC592441DA7CC8DFE65D82F08DE832
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1688 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\7EB5.tmp

Filesize
428KB

MD5
2323cbe96ee896fd0a7a6bc5acdbed85

SHA1
ddc6836528215bb4d881b17f78a73c7338367904

SHA256
6c88b8158cca5c051c58f1f529e8749057def8177b2d423eacba0b2b879cdc39

SHA512
33a2d2f33631f1622d569c9cbad2c9a843ae4d3e40136b7da374ec8f0d19817e979ee481b8e04888b46d337132aa603b079b9f0556bfce36c87a792caa9f7ab9

Download Submit