6e0a506508a76afa2e312c188fdd7c7b53d1f0e60e950be6394aa5dd3cd94118

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 13:38

Target

1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe
Size

324KB
MD5

1b809145405f7d103ebfe176ef50838d
SHA1

0bf2722e8099b1cbbed95261e58dd12709a53303
SHA256

6e0a506508a76afa2e312c188fdd7c7b53d1f0e60e950be6394aa5dd3cd94118
SHA512

d9dfff62eecc2e28dbdaef56dff13e7d496fd76e4684149a6dbc2dd08f6f99537617628241f0a28f41fc1a6caa48b217a94f9acaf1361f5ac22099940259b72d
SSDEEP

6144:guTvtvjzxpOd90IzWCRow1W0y1KX6FiqL17J8:Lvtv3xpOd/KCRoP06KX6/17i

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94
PID 4644 wrote to memory of 4076	4644	1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1b809145405f7d103ebfe176ef50838d_JaffaCakes118.exe"
  2⤵
  PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3776,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
1⤵
PID:4464

memory/4076-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4076-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4076-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4644-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4644-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download