0f1e40d404d7deb39a253e43f7be422f4e9571015ff38a58e4d08c6c30dd3538

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 22:34

Target

11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe
Size

1.9MB
MD5

11c1896501dbf56a1b03f53cfdf9b9da
SHA1

72be2a9c2661c94c3d4690641db2c7a9304fc07a
SHA256

0f1e40d404d7deb39a253e43f7be422f4e9571015ff38a58e4d08c6c30dd3538
SHA512

ebd4d967e3a4777dea6c1b29209d32340fb78ebf51ee181879a881043d8b0cf9db84d718a16d930ddf6d696c2e31d7c29740ed8b322531ac03ac96b7501888ff
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dCxhRimeCJ84d+K3nzTfNcGqiFPs12X8m3+Vn:Qoa1taC070dYDjeCddXzTWsPJL39pjAZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1452	36B0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1452	36B0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1452	3596	11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe	89
PID 3596 wrote to memory of 1452	3596	11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe	89
PID 3596 wrote to memory of 1452	3596	11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\36B0.tmp
  "C:\Users\Admin\AppData\Local\Temp\36B0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\11c1896501dbf56a1b03f53cfdf9b9da_JaffaCakes118.exe 6316FA420989E7645C46BA7C1E9A79F6200F6EB3343D0646F2E5BFB26894B8313C98F87F00BAE63B0050CFF90CE4599A9458DEA4B07EC83789539546F7AA1498
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1452

C:\Users\Admin\AppData\Local\Temp\36B0.tmp

Filesize
1.9MB

MD5
4ae89a0fe85121e341bab76b5802696e

SHA1
3cd84fcf6c0307616c772d9bd41e4d83f064708a

SHA256
bcef08f3222dc81e2142048b47523969a064796f71ffd4e18d622f9c56357980

SHA512
079567b2bc6e833eab3687354081f4fa367829cf51e9ee9491a1622d9c4b3be9316d6c7b42ea89677e93b72aca79ddc2e35701bdee0ad002420ca4b5e7111401

Download Submit
memory/1452-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3596-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download