f768673631bbbcbb6f4c119994fb4ecb8c4090c41cfee86fc6e46860583241da

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:14

Target
8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe
Size 8.2MB
Sample240602-28effaaf4t
SHA256 f768673631bbbcbb6f4c119994fb4ecb8c4090c41cfee86fc6e46860583241da
MD5 8fc57cf6c5966cb0880bfed05e442320
SHA1 5b492b991d20c8e9dd2038104fba86abb8a4eb5c
SHA512 82e14eef2d700c976cc8bbf97442df6de37d805565e184f9251af05cb44353e4a9451c2edd38a377357ae536b09a8f1168057b0cb6f2458aac9d3eeac65307ee
SSDEEP 196608:4P5RveFU8MXMMONfwutJ+5y+DsEvnAt+sum:E3veFAXMldtI5y+nvGom
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5092	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5092	1072	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	91
PID 1072 wrote to memory of 5092	1072	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	91
PID 1072 wrote to memory of 5092	1072	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\is-81JVT.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-81JVT.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp" /SL5="$D004C,8350975,71680,C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3816

8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-81JVT.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp
Size 704KB
SHA256 4b4a352f1d37076245c0dfb9691debbdd71e2d1a111ab4114d6ea63e26fca00e
MD5 668fd6d9e6db663b9a16169bbed6b2ef
SHA1 7bbfbf7c6e0d4f3b0347a3801dc76e6919788820
SHA512 2bd381643dd3a0928370e45bab0225abb66a2df395285313ba94795f583ff51ebb667427b2994db390d5d1c02735894248b5a3a19d297daa99aad01b5902d078
SSDEEP 12288:XTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5wURNRx9QF:jPcYn5c/rPx37/zHBA6pFptZ1CEQq5RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1072-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1072-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/1072-12-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5092-7-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/5092-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Download