faca6e88208fa73daf98687795281cb437cd15c4f8100a494cf78e8ec3a09b5d

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 21:45

Target

2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe
Size

448KB
MD5

ce9812687db2250fafad3ad30ba2ae4b
SHA1

1151e8e2e5b9a7eefe3f73d53a557cd526c2739a
SHA256

faca6e88208fa73daf98687795281cb437cd15c4f8100a494cf78e8ec3a09b5d
SHA512

ce84fb584c62453f5f307ea56b281637704c69f8ba6e22e943343835949224b0175822b10ccbcb672596409394e537a3d2492ab45e32d39f91e52086e64b214d
SSDEEP

12288:lb4bBxdi79Lh25a95jmQmhwdux+z+K8hTklRA4:lb4b7dkLoUS9hgucMTol

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3972	E80E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3972	E80E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3972	3508	2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe	90
PID 3508 wrote to memory of 3972	3508	2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe	90
PID 3508 wrote to memory of 3972	3508	2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\E80E.tmp
  "C:\Users\Admin\AppData\Local\Temp\E80E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe 92C530A1E68C5D030625940CE924C7593371F9C057065880E165DADD4BD92EAAB1C691B83651580F67C087BBB1FD121E4A60D6C25E69B6ED90EFF10CA20C80F6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2284

C:\Users\Admin\AppData\Local\Temp\E80E.tmp

Filesize
448KB

MD5
dee2dbe957117f8f3d39feaa2da57900

SHA1
5a69378da221ff1f424bec48160e0c82ed707dd3

SHA256
c551b344b14e3dfabc38d6cfeafe55feec4bc0943aae47856ed5c2316bd02c1a

SHA512
87a04868d3e8279f729f57e951c4f7bb838b768a6abe5d45c09bb6e8a5f0d1b2813f73b47da3131e98579c914aadef295dfb3b7061df05ee1fa69f341cf5df65

Download Submit
memory/3508-0-0x0000000000F10000-0x0000000000F89000-memory.dmp

Filesize
484KB

Download
memory/3508-6-0x0000000000F10000-0x0000000000F89000-memory.dmp

Filesize
484KB

Download
memory/3972-4-0x0000000000480000-0x00000000004F9000-memory.dmp

Filesize
484KB

Download
memory/3972-7-0x0000000000480000-0x00000000004F9000-memory.dmp

Filesize
484KB

Download