83492a38b7527691e1d98a997607dad9c7aceb5e3e6b5d63fd191bb58a1c4d86

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 10:45

Target

9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe
Size

4.1MB
MD5

9dea1c7a3d859f3ec07b43d53ec0a884
SHA1

046e9103096c665fa8ce64154c9ad8da3d549357
SHA256

83492a38b7527691e1d98a997607dad9c7aceb5e3e6b5d63fd191bb58a1c4d86
SHA512

d195ff85448fa2b83c7b44ff214da967164764bfb791a13f27fee8f931c316f88f1aa0831ac3eb3963f3d6da018ef6b1a24461558eb496e24efcf9ffa32b7dba
SSDEEP

98304:QTt8cDZqNlY0W4aWzvk631rxEdB8t/lExcPc383iA65Uke+:vcD2Y0WoFMd1aPu2B656+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2116	9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2116	1140	9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe	91
PID 1140 wrote to memory of 2116	1140	9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe	91
PID 1140 wrote to memory of 2116	1140	9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\is-H0B2T.tmp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H0B2T.tmp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.tmp" /SL5="$F0046,4012092,54272,C:\Users\Admin\AppData\Local\Temp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1616

C:\Users\Admin\AppData\Local\Temp\is-H0B2T.tmp\9dea1c7a3d859f3ec07b43d53ec0a884_JaffaCakes118.tmp

Filesize
688KB

MD5
67c5a4f36e1c91a3b85e440edd7ad026

SHA1
e49ea0e558ed682498cc61b3070e4c402fbf0912

SHA256
99c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6

SHA512
40522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e

Download Submit
memory/1140-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1140-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1140-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2116-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2116-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download