16beb51db5cf471e6bf1fe883d4a48e163035d1f815d146e1c262feb6f6f1fac

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 21:44

Target

10d54d3420877345937de6fae4142eea_JaffaCakes118.exe
Size

2.3MB
MD5

10d54d3420877345937de6fae4142eea
SHA1

b7423a81ae49e8438b03f284d3d9e871c3a9fb6c
SHA256

16beb51db5cf471e6bf1fe883d4a48e163035d1f815d146e1c262feb6f6f1fac
SHA512

f162d28c5c9e158af059de121d3ba2dd641a610fa6076dcbdee9ca674bb4104e23fe29020825aee1a80cfdd3f0bdd0b0a862355ef754004b5c3703b2ca25afb4
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRW9Zce3FPw58OV1:dqgazxcGYN139lnk30rDEYqMpO8BbNDX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5088	tx.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ywf\tx.exe	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 5088	468	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	87
PID 468 wrote to memory of 5088	468	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	87
PID 468 wrote to memory of 5088	468	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\10d54d3420877345937de6fae4142eea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10d54d3420877345937de6fae4142eea_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\ywf\tx.exe
  "C:\Program Files (x86)\ywf\tx.exe"
  2⤵
  - Executes dropped EXE
  PID:5088

C:\Program Files (x86)\ywf\tx.exe

Filesize
2.3MB

MD5
b16a0c19b543c8c0f228186c8c9705df

SHA1
80686c9c633abed682e18b1a61bfbae370077091

SHA256
a6161a1924d19b8c0091aaed91b82aa5f16b437e2ae52b28bff51102ca84d2ab

SHA512
241eeec545754fbecdb9ecebcf6e9412beeb35a74b1f8bf96a213f9c0939140565dc01dad8f6da0075aa5d6e0d1e0bc6ecdcc6b6a9c857f123bf053c6411dd0a

Download Submit
memory/468-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5088-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download