b6c940f2d91689a016247101b40dfcbf32a3f821776e6ac43e86dcafc1321ca4

Analysis

max time kernel
130s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 20:19

Target

f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe
Size

1.9MB
MD5

f1d743d689bcb88b802552dcaad84c03
SHA1

50115b56eb414a018121a8df2fb25b100ba3e3c3
SHA256

b6c940f2d91689a016247101b40dfcbf32a3f821776e6ac43e86dcafc1321ca4
SHA512

b59f51dfb0fdd7d900e3060677d20f2d16d6d358f29509f8859b398526d5bc78638a1eba6f655f46e9e3327ef23631a2903c743a5dd719340715ac2914912cc2
SSDEEP

49152:Qoa1taC070dwblCFDf15b4Xfa4CPRXe1qQAFJo3V2k:Qoa1taC0/ezP8XG5Xe4TW38k

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4312	2A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4312	2A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 4312	2524	f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe	95
PID 2524 wrote to memory of 4312	2524	f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe	95
PID 2524 wrote to memory of 4312	2524	f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\2A.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f1d743d689bcb88b802552dcaad84c03_JaffaCakes118.exe 0B935AEFA07C08E4609B87AF238E75FC20BC81DD3762A7C07B4E5E37FCD8E6C25E2D15E80F3CD44B688D7D2CCB47A6949AEEF0DFAF5778589AB24F62D4A70CAB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3848,i,10311142765129381054,10604297278945507215,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Temp\2A.tmp

Filesize
1.9MB

MD5
e7684e3e09b77a1d6c3b34c15e721457

SHA1
73ed29885d5f91a4ecccbee9f0de2b6185e65ac8

SHA256
55537e89dccc45b9bcf768c86423f96b17244d8a791dbd02dce4d6c0e61c915c

SHA512
957375b4b21712f2faecfb7924179504f24975acc33e1ae9c71b848bce0a5ff4be7da93967d888228a97d177ee860bfad56ccb04d9dfd1b1c041d15db3bfb1f0

Download Submit
memory/2524-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4312-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download