7bd4b7f90bfba775340a76010c751882eb30f83d6986495eb060a0752d0445b8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:26

Target

c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe
Size

1.9MB
MD5

c70d05d2e59d284bdf44ca44b023d304
SHA1

88dc6455c269f5965fe7a1e4526fa3789628d184
SHA256

7bd4b7f90bfba775340a76010c751882eb30f83d6986495eb060a0752d0445b8
SHA512

6e666f7b26c256a41f7ac0f09bb2c2101c60b580bf02e0169e7dc48672fee0def357d91e7690282d9bfd32bbb5e051f670a3b686e8b6d2bd728a32947251d35c
SSDEEP

49152:Qoa1taC070d7byvUKr9cYFiZUEKP+K2zvAqELpP:Qoa1taC0p3ruS2UEm+KYvAvlP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1036	77C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1036	77C0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1036	5048	c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe	93
PID 5048 wrote to memory of 1036	5048	c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe	93
PID 5048 wrote to memory of 1036	5048	c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\77C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\77C0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c70d05d2e59d284bdf44ca44b023d304_JaffaCakes118.exe 2A7A8FBACB442BBCE35EE7E44818E773D310E22F5C570499847CB39BB3F4378781D365C8BB3C97780A2300D66BBAD37F3286B7F64236E007C5E34EB612A602A6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\77C0.tmp

Filesize
1.9MB

MD5
db1431f90819022bc34845df8c109a75

SHA1
f100452c33e5a7b39c22127eb119ddc2f5e56c39

SHA256
627451baca909770846c9375c572e1fcbb55f28b6c5e54d1e208e522bb638dc7

SHA512
27a84124df61a1b199cdac297194c1a24e4aca215d26052629d121ce7b61de8472daf70dc078305108e6caf4a813197c6ed5df5b45e37047e32cdba8977811da

Download Submit
memory/1036-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5048-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download