b4ad73d42c7afa30b42b733abc50ebd82bd683941e7b1ffd320ebf2f3a1f9f95

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:56

Target

2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe
Size

428KB
MD5

8785c37eb60f86e7d0535402e9864748
SHA1

09acd04f7bbe760eba91aee5e5ecce0c572a524e
SHA256

b4ad73d42c7afa30b42b733abc50ebd82bd683941e7b1ffd320ebf2f3a1f9f95
SHA512

27247d1e5810583279e97e9f0122bce492a3c2f64b4cca912d1614efce6fccc7b6bc912fbb6068750cbf57eb0fa9aa0274ebedf5f9ddc57b4239d9e6a05f491e
SSDEEP

12288:Z594+AcL4tBekiuKzErEuW5mzdNy6pTKmyIYPQcul:BL4tBekiuVrEuW5i/pt5gBu

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4976	F3E5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4976	F3E5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4976	1504	2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe	92
PID 1504 wrote to memory of 4976	1504	2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe	92
PID 1504 wrote to memory of 4976	1504	2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\F3E5.tmp
  "C:\Users\Admin\AppData\Local\Temp\F3E5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-05-31_8785c37eb60f86e7d0535402e9864748_mafia.exe CEEFB129EF6A59CCBABC222B255AC12674F066C2CAE2903C3C7486BFA5576AEEB29E921605ECDB11FCDF37547FD91AAA678FA1F368F7DC118D10D327B1C74EF7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4032

C:\Users\Admin\AppData\Local\Temp\F3E5.tmp

Filesize
428KB

MD5
2934a50aa3390c157523bc305c37b100

SHA1
037cf5af1b692abb30477e171a661d818322088a

SHA256
12069cbd9b674ec35299bae822b5036bb05a22f8e9c3d4e2b2355582a8778f09

SHA512
a5e220923004dc6de43dddebf3eb7c480cbc2d7c417fbfb9d8aa7f6bab0d2e3037842a59cf5e99d2a43154bc66cd2fe2defee3ca7799bc7df1d095fad4776423

Download Submit