6d1116bf3c8871af8b665a3095ed823f8bc3ccf55aa0586e51c2848c6882f3d1

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 19:24

Target

2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe
Size

443KB
MD5

0db47848b8533b40f8f71ea4919ec5f6
SHA1

37004ccd40189fc42a35b5dc7ef5bc91ed8d80cd
SHA256

6d1116bf3c8871af8b665a3095ed823f8bc3ccf55aa0586e51c2848c6882f3d1
SHA512

4a015fcb3acb1117fdd0e7b43ca131535b96b6d621a5e53fe5dc74173bd411e08fec316753fb21961e69f4f048c3157f5cbc850b6aa8b075a990f9903d053e53
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BY0UJaH2oNsnNvU1it2iw/635G8k+SlMa:Wq4w/ekieZgU6dU6BGgTipFSlMa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3368	F5AA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3368	F5AA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3368	2432	2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe	91
PID 2432 wrote to memory of 3368	2432	2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe	91
PID 2432 wrote to memory of 3368	2432	2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\F5AA.tmp
  "C:\Users\Admin\AppData\Local\Temp\F5AA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-22_0db47848b8533b40f8f71ea4919ec5f6_mafia.exe 43F6B989F78C3401A2B4FB0FD93B81BD2574D0B9BD3130DB8A8B9AACACF4D41AD2AD6CF55CB6F6E0DEE9F4B0069E2024498B63E11DF39A89923E95B0931BF644
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4620

C:\Users\Admin\AppData\Local\Temp\F5AA.tmp

Filesize
443KB

MD5
7a7bb05c1a80a6c3745d8efdc97c738d

SHA1
20e5f4d0f31103dcfe2f1724bc7589937c13abc7

SHA256
d5b0da4501e999baddf0f08d9f074769893cd35f2ecdb8dcc6a80c337ab5ba99

SHA512
a1d7eb86468f8f1d48caf08cbacd50873102a1be5baae685ba87e3903cc58561a0f1bf314de5bf17fd8d0c3112fbfc8f8b63cdece9d456d81eb5db33713f07ee

Download Submit