3605e4cc7fc6449aee07ea150ea77d24e83239de67d1ef8c5b1ce71f70ab02cf

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 03:44

Target

2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe
Size

486KB
MD5

94e7ef38bd8d6e4706f44fca641fb5fc
SHA1

0c0bc70b2e3ecc1a4049a2839702fac7802db13b
SHA256

3605e4cc7fc6449aee07ea150ea77d24e83239de67d1ef8c5b1ce71f70ab02cf
SHA512

e89167e1599cc53df46a7666b90d3769f4a28fc4b4582f314679f70871f5a547db1125e54d2cb51520b982f324d47e47c71e68fb75f8d0fcea2048f882b1458e
SSDEEP

12288:3O4rfItL8HPSmvcyavy5zPeno2aTS7rKxUYXhW:3O4rQtGPSm30y1K3KxUYXhW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3528	B352.tmp

Executes dropped EXE 1 IoCs

pid	Process
3528	B352.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3528	2156	2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe	96
PID 2156 wrote to memory of 3528	2156	2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe	96
PID 2156 wrote to memory of 3528	2156	2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\B352.tmp
  "C:\Users\Admin\AppData\Local\Temp\B352.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-11_94e7ef38bd8d6e4706f44fca641fb5fc_mafia.exe 6DC593F8400FA07957A08C7502067D5B2EA8117794FD285D482B5B33A9AF76260159A10D36F90DDAC264586B991361298C63C8CE24BDE8116E4F6BC02794BA14
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:1492

C:\Users\Admin\AppData\Local\Temp\B352.tmp

Filesize
486KB

MD5
feb7665df47dcb4076c92f7196ff6527

SHA1
1ebc4a71054549ef97597424598704daec73aca6

SHA256
ec62dd55c15e23f634cc18e085ab703379eb3c7f0410168f0cfffdf694666e1a

SHA512
bd59e9a5736e20e51aab288ccab4370d0469e2aaa4d3e236d41575a2e0422e6c9816dcf85031494cb338ecaae8ef6612b9e6550bf1791dc5734761b3339c922f

Download Submit