7e38871b4d0fb3a2dd47a7f1ccded1780139cf983ff0162e6e544e2fa6c81976

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 07:52

Target

45324577c2913b784e246ebe626d0662_JaffaCakes118.exe
Size

13.1MB
MD5

45324577c2913b784e246ebe626d0662
SHA1

8a3d0ef9f2dc1a1dbc50b4cca6a03e2b05b89a29
SHA256

7e38871b4d0fb3a2dd47a7f1ccded1780139cf983ff0162e6e544e2fa6c81976
SHA512

42230ade8ae6fdc6f215c3da1d71430b62e52e722565e6dfcbf12562e5091702a8885754dc83af73964d6d4ad0894b456f0de30931b2831db142b7eef82e9ec6
SSDEEP

196608:aoxQIsR69t+PHJ+3M99+oVkQwo47Xzl+RcW+ync7yFWBNRhCoqW3E3Tj:RONR69tWn99t6QwZXvPyIyFWRqW3ATj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3700	45324577c2913b784e246ebe626d0662_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3700	1560	45324577c2913b784e246ebe626d0662_JaffaCakes118.exe	90
PID 1560 wrote to memory of 3700	1560	45324577c2913b784e246ebe626d0662_JaffaCakes118.exe	90
PID 1560 wrote to memory of 3700	1560	45324577c2913b784e246ebe626d0662_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\45324577c2913b784e246ebe626d0662_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45324577c2913b784e246ebe626d0662_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\is-BTVEG.tmp\45324577c2913b784e246ebe626d0662_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BTVEG.tmp\45324577c2913b784e246ebe626d0662_JaffaCakes118.tmp" /SL5="$601DA,13441023,56832,C:\Users\Admin\AppData\Local\Temp\45324577c2913b784e246ebe626d0662_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:400

C:\Users\Admin\AppData\Local\Temp\is-BTVEG.tmp\45324577c2913b784e246ebe626d0662_JaffaCakes118.tmp

Filesize
694KB

MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
memory/1560-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1560-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1560-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3700-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3700-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download