668a0a05597f60eb9f89b6a07ba88bba72b851719cfdeb70e3cafeb0b7bbd750

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 15:24

Target

41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe
Size

224KB
MD5

41fb02fa2d858df5435f15065ac03339
SHA1

911858b17282261c43aaed4b00fe9d085f66904e
SHA256

668a0a05597f60eb9f89b6a07ba88bba72b851719cfdeb70e3cafeb0b7bbd750
SHA512

b290038dcd2a140e630bd30e0442bc69bd6708ee650ff1f5ddb14b2f34f49e90fe15a055711f65c3e6a660e2fc93007dd2c304fc3a29db4b6b709ec1d7d1feec
SSDEEP

3072:zM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AViaO4V:zgzQ+D7ljXma/WxSTi7rT8xHY64V

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
764	phonglabels.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1924	41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 764	1924	41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe	91
PID 1924 wrote to memory of 764	1924	41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe	91
PID 1924 wrote to memory of 764	1924	41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41fb02fa2d858df5435f15065ac03339_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\phonglabels.exe
  "C:\Users\Admin\AppData\Local\Temp\phonglabels.exe"
  2⤵
  - Executes dropped EXE
  PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4092,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\phonglabels.exe

Filesize
224KB

MD5
41fb02fa2d858df5435f15065ac03339

SHA1
911858b17282261c43aaed4b00fe9d085f66904e

SHA256
668a0a05597f60eb9f89b6a07ba88bba72b851719cfdeb70e3cafeb0b7bbd750

SHA512
b290038dcd2a140e630bd30e0442bc69bd6708ee650ff1f5ddb14b2f34f49e90fe15a055711f65c3e6a660e2fc93007dd2c304fc3a29db4b6b709ec1d7d1feec

Download Submit
memory/1924-4-0x0000000000070000-0x00000000000BA000-memory.dmp

Filesize
296KB

Download