06f98940dd95e5e951f4e5930103c7b0bcd1ea75b6d1c7fd71ad146b081a40e3

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 11:43

Target

2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe
Size

443KB
MD5

b41dba88e75e9d892853cf41a1bf7abb
SHA1

efb40cb92b8333466caca25722a7cbf2ec8b953e
SHA256

06f98940dd95e5e951f4e5930103c7b0bcd1ea75b6d1c7fd71ad146b081a40e3
SHA512

c7486e8513cc99e9a34ed7dc1ef8d7c3d7f2fbff39c889bffdc9dea6e71b49a04087e58be73675d328ab813c424602e66c2316b37314ea13493bab22af8674a3
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BYbaVrl6fnuVSybkT4Te0aIPLkFBlMa:Wq4w/ekieZgU6aSUQFNe0DDk7lMa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4824	4A43.tmp

Executes dropped EXE 1 IoCs

pid	Process
4824	4A43.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4824	4344	2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe	91
PID 4344 wrote to memory of 4824	4344	2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe	91
PID 4344 wrote to memory of 4824	4344	2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Temp\4A43.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A43.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-21_b41dba88e75e9d892853cf41a1bf7abb_mafia.exe 6C85EFC706C1CAF506D0E7F4A89FE03974D28B048B90FD11E9397E628F55DA485965B732A2C1F83B81849B02774F13241521C055985D54A9B499A2A3A0C4E6EF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\4A43.tmp

Filesize
443KB

MD5
2c85ddb50e52e1f53a3fe18dd0352da0

SHA1
430e5717f36748e6be10fd64e072c1bbb23786fd

SHA256
63183c030da35c15f9336523eb029172d3bd3f211ab03780b0b16512a9596052

SHA512
ad9f0745f7dce1870b88ed21e0d8da9a277a568ac9ff0e9813127af311d8f0c3cc8c7343a223e8158c5357338ab9ec0c894c5d32f446e95b642668a7d43a0d0c

Download Submit