d2fe589a7752536341d76fc25591327511551e3470237412c5565a31231446ea

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:48

Target

1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe
Size

1.9MB
MD5

1ed03c3eff0c1390f9142cbf94354916
SHA1

dfdeef554940c277fa8a83cddb38b81a3903cf66
SHA256

d2fe589a7752536341d76fc25591327511551e3470237412c5565a31231446ea
SHA512

4680d657ecdca0cd0044e006a8a647f6c6938f735d0c13b43e9b1a653ec244e57e19cd475e379615fb8411c2cf4ebfc0f4a0e0b0d24b839464be03bf114ed35b
SSDEEP

49152:Qoa1taC070dvHnAnu2OP96p42hWvZIgR1iGtpr5D1VKsrWmf:Qoa1taC0sA096FkIG5tpl7K8f

Score

7^/10

Deletes itself 1 IoCs

pid	Process
888	DD7F.tmp

Executes dropped EXE 1 IoCs

pid	Process
888	DD7F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 888	1640	1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe	96
PID 1640 wrote to memory of 888	1640	1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe	96
PID 1640 wrote to memory of 888	1640	1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\DD7F.tmp
  "C:\Users\Admin\AppData\Local\Temp\DD7F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1ed03c3eff0c1390f9142cbf94354916_JaffaCakes118.exe 30A8A0DEBACAD986B81E28B2696B40A14224E1FCD103CAD85F822AC40D4AAF141915127D6BD3649D0EFAF2B2BFA0DB7D0B2B3291C9C5722963CAE4E2CC553AAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\DD7F.tmp

Filesize
1.9MB

MD5
bc65a6396ce64b47048f3d15818a8154

SHA1
c6a1606dccd93b1ea32071c63ab57c61b4270df0

SHA256
30c6ed15ba66e151e9d61f3ab1b8234831a2da35fe3f8c9f0a62c1766a228d5c

SHA512
81b94c438eee64c38f8907519bc73e3c590322cb7820f3622b96a509c5cc1e7702cf4bbf966f5f56727af7ba49266604e16f4ab41c3392aee16c75f7a3de9d84

Download Submit
memory/888-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/1640-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download