1e481ca2092621d936835dc3bf62c955027945effc5c2b2eda846c9735b60845

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:31

Target

b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe
Size

563KB
MD5

b6c3c2f3671ec8dcb8f5a71d106582cb
SHA1

d34b4189f57dd6042e284cb9431d75befae624e8
SHA256

1e481ca2092621d936835dc3bf62c955027945effc5c2b2eda846c9735b60845
SHA512

61875cc0031932726f17371a7413f9f07aa85d73b79dad5089a6962840788d7ee1ef0cdd80262ee19eb8f610fde07613974d0c1560ab6cb1211f888920464322
SSDEEP

12288:hQiGWmbHX0IH0dZNvDBPMACmbHtOXUg8kEhmqVqjxqUqvhd56bna8j:hQieHUZZD9Cm7tOkg8kkmcqjsFEbl

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4872	b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4872	1960	b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe	89
PID 1960 wrote to memory of 4872	1960	b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe	89
PID 1960 wrote to memory of 4872	1960	b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\is-NVMP2.tmp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NVMP2.tmp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp" /SL5="$D0052,326014,67072,C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,16856304285138459032,14480077487839828721,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\is-NVMP2.tmp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp

Filesize
700KB

MD5
f61ce5076b8e33c722dcf5380127fce1

SHA1
20d50e6db499e53b71a54cd3368cd89e170a02d2

SHA256
0d1ae8888ffb53cdc8cfe002849225d10c20fa7cb52c9b756724fc013a99d71f

SHA512
a83d755c3b2a374bdbea96487f136377a9abb4be53c1f1eff77a308a4ab21a66158c945ce32ae36ba8e79b468d2dd32c7956cb6ce282c21a2e917796b79df07a

Download Submit
memory/1960-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1960-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1960-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4872-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4872-13-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download