c6b247f47e0307939deebf14af2e55a34260a0b8b207f9723d2fa7b81b0a6ae6

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 21:45

Target

2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe
Size

433KB
MD5

d4079318d66d5c32c92ee0e45a017ed8
SHA1

cb251610e84d940deec2136ecc400c34c1e16611
SHA256

c6b247f47e0307939deebf14af2e55a34260a0b8b207f9723d2fa7b81b0a6ae6
SHA512

fc6e482bbb1d9f0d6797e34f46c3d44fd50e852449771d25017c15b141e8005f625b3a9f55552776edbc36f840ab5416a27be6413d0c786fc75b667a058faaad
SSDEEP

12288:Ci4g+yU+0pAiv+R/gr8pgc0BT+zz0zBSoA22Ji/GDiWn:Ci4gXn0pD+JgrzBizz09S62JvP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2812	77D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2812	77D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2812	2260	2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe	93
PID 2260 wrote to memory of 2812	2260	2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe	93
PID 2260 wrote to memory of 2812	2260	2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\77D.tmp
  "C:\Users\Admin\AppData\Local\Temp\77D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-22_d4079318d66d5c32c92ee0e45a017ed8_mafia.exe 2847428E0A7655146A7169AE7F012D7126AED571698AEF846E22DDCBD782A2A4A817120EF5F313DCAB504AA5A1AD0B886F44780A0884A82A412AFDD0264C454B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:3592

C:\Users\Admin\AppData\Local\Temp\77D.tmp

Filesize
433KB

MD5
61bd2100aa9f66e86f6d961600fd2416

SHA1
2d1cf922de4a1039759888cae7ec11314ba8f717

SHA256
f6bcb8804726f8403dbf3ba313f5d35153c4196c88a01e2262717e4391072223

SHA512
27048eb22fca81954141aa4580c3a43f7e04681a363f387fd31b4832259ab7dc0eecc716a9cb1b27705a33011997cf98f84727114de0293b7c369109387b89ec

Download Submit