4b646ff82c33d96be878dcac5455d7c36ac34555e534d1d6ddc50c6990571d6a

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 21:38

Target

2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe
Size

448KB
MD5

a67436efdcff8ac30aa8d44b8540d579
SHA1

9ff1c8537be8de62075de8fd7232dd4243f1422d
SHA256

4b646ff82c33d96be878dcac5455d7c36ac34555e534d1d6ddc50c6990571d6a
SHA512

478e0294019bdf5b8aa490572d54e5a4cb24991a36d176369253499981db36e0698dd973f617c2026aeffbc2123a97a4fd98db8b8b2f2dded8b8c9f987fa3bcb
SSDEEP

12288:lb4bBxdi79LKqVEEiEquWCL1KEv11k8gc/A4:lb4b7dkLKqVEkqZCFvU8z3

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3596	9848.tmp

Executes dropped EXE 1 IoCs

pid	Process
3596	9848.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3596	440	2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe	96
PID 440 wrote to memory of 3596	440	2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe	96
PID 440 wrote to memory of 3596	440	2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\9848.tmp
  "C:\Users\Admin\AppData\Local\Temp\9848.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-09_a67436efdcff8ac30aa8d44b8540d579_mafia.exe 4A4908EC96072842FF95DFE0D7915016B23D3CD87BAD380030677E1A3384EDF4353A9CF1E6E175128ECC73FE42E44E6DE77884B4A4DD9DC4E8CA6A6C6A07D94D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:2412

C:\Users\Admin\AppData\Local\Temp\9848.tmp

Filesize
448KB

MD5
6ab2f17990881acfcc86d4994cdda6be

SHA1
76ec4e595222aa2ffe8b26ae242c9f7b36386452

SHA256
fa4f9b913d2da389638545e17e3df762787c463f35c8e94a8337f97a086098ab

SHA512
d405c63ca3300fa7c2ea419ff1af7e2c0c8bd58e07b5b1d7e4c198e5185d5d214c9afdfba49ec05ecafd24ccce160e516fd161b1aa4510c630b07a45fb89fdfa

Download Submit
memory/440-0-0x0000000000FC0000-0x0000000001039000-memory.dmp

Filesize
484KB

Download
memory/440-6-0x0000000000FC0000-0x0000000001039000-memory.dmp

Filesize
484KB

Download
memory/3596-5-0x0000000000C70000-0x0000000000CE9000-memory.dmp

Filesize
484KB

Download
memory/3596-7-0x0000000000C70000-0x0000000000CE9000-memory.dmp

Filesize
484KB

Download