155496ccb6e2f4c83cad6ecc65522bf79204d8a20fcdd00c150e719fb2514f5d

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:01

Target

15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe
Size

286KB
MD5

15c0acd132a51d5796c5d82a89434231
SHA1

8f984dcf78ea1e11dff5dce849f9ffcc62fe3269
SHA256

155496ccb6e2f4c83cad6ecc65522bf79204d8a20fcdd00c150e719fb2514f5d
SHA512

dc0e393d01ff5fa13710bcde72f87c0db52dcf1ef60631d2fa794e1208d917c369c29bb21b3eb265e592cc451c06dafddfa2fac811d8120a353ced63d4607172
SSDEEP

6144:MMOxZriTKByhvPjytTZpvyBFSxwIdRwllHvqkWy:MMOxZrifPjytTZpvONId

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93
PID 4804 wrote to memory of 4704	4804	15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\15c0acd132a51d5796c5d82a89434231_JaffaCakes118.exe"
  2⤵
  PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
1⤵
PID:2692

memory/4704-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4704-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4704-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4804-0-0x0000000074F12000-0x0000000074F13000-memory.dmp

Filesize
4KB

Download
memory/4804-1-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4804-2-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4804-3-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4804-9-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download