5e321be2999b0d11bd0158684de3cf44296e90347b4a1e0755247427870efaa6

Analysis

max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:28

Target

033e840c32827abc3bcfb79541186375_JaffaCakes118.exe
Size

1.9MB
MD5

033e840c32827abc3bcfb79541186375
SHA1

583c51f19df7e29e7ab073e72e1905e39b517fac
SHA256

5e321be2999b0d11bd0158684de3cf44296e90347b4a1e0755247427870efaa6
SHA512

852325d295b6a1fd08a84cf06d4512787f30bd29060a1a6801dea4177bacab107df22b47b0522e9cdfbafffbf8d4fc5eac9679226016c577207c72498adefd99
SSDEEP

49152:Qoa1taC070dEUnax3z6Hj1aZFz/pcNMlb4E8WmkE3Px:Qoa1taC00nL0DzhcmvmkE35

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3344	87ED.tmp

Executes dropped EXE 1 IoCs

pid	Process
3344	87ED.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3344	4840	033e840c32827abc3bcfb79541186375_JaffaCakes118.exe	87
PID 4840 wrote to memory of 3344	4840	033e840c32827abc3bcfb79541186375_JaffaCakes118.exe	87
PID 4840 wrote to memory of 3344	4840	033e840c32827abc3bcfb79541186375_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\87ED.tmp
  "C:\Users\Admin\AppData\Local\Temp\87ED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe D4CEF508E3913BE11C206F3CA9299C1F17B55D7525EA40351446AECE378AB794551D121A5682019D4A787069C02572501B20BF3D5B56BE43FB80E48BED6D5E93
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3344

C:\Users\Admin\AppData\Local\Temp\87ED.tmp

Filesize
1.9MB

MD5
26acd9046d5c4b830195fac14dad721e

SHA1
dd16668f463194c452527bb754c26e5c76270da2

SHA256
bca4198dbe016d8d81fcc0f9cdf92c45fdd21ba4489dfa37179c8a90eec36252

SHA512
82ba034a58b83b31c3f30658b2e3ef871310c47e59a70b112eeeaaeed18daef35a8049480ce7d8c59c7ecea3df8eb663e47e41f3bead70e62bf4152e565ceb7c

Download Submit
memory/3344-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4840-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download