9617a654319d8f472663ade2a440f499b482a6983a45f152c5297907248a4b43

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 17:59

Target

087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe
Size

44KB
MD5

087195281b5e1bc9775c4d109d6bc222
SHA1

35333e5e947c1929787b010f581e435497d22057
SHA256

9617a654319d8f472663ade2a440f499b482a6983a45f152c5297907248a4b43
SHA512

2c4a6a19daf3bd1b37df6f2dd6567253d440bd8c22f9a3272c0e7c6f42c4d706fdfe5054ecb740c585827dd8ae8641d695fe84fd141b12554586b22edcf1f083
SSDEEP

768:gRrKKTY6N7sAC3X679CqdJVN/1ErTw+3FLyvu39icW49iCm4JW+s4:gRrKKTY6NuH67V1/Cr8+VeO9iujm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3084	sxeE0BB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3084	3268	087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe	89
PID 3268 wrote to memory of 3084	3268	087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe	89
PID 3268 wrote to memory of 3084	3268	087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087195281b5e1bc9775c4d109d6bc222_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\sxeE0BB.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxeE0BB.tmp"
  2⤵
  - Executes dropped EXE
  PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
1⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\sxeE0BB.tmp

Filesize
43KB

MD5
97f2611bc1501352cf4810994edc5530

SHA1
9b0f99b86cc5f2f4dc51c58d23e7f857261fb5ff

SHA256
f3bc48eca39f3ad36eafc967c83582419443c487a73ed5ea892f3162914156d7

SHA512
afc9d7dfccabdcf6dd24e5557cf2fd5aee12b215bc55f41a36532363df8925470eb0bf9d2289e2a1df861b648835a408e3700fbf51b880abf19089d87adc3eef

Download Submit
memory/3084-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3084-12-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3268-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3268-5-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/3268-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download