02577dc581e6c430a65bf3dd800afb126632007ce2e4390f0d397a1d0d690468

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 15:49

Target

09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe
Size

1.9MB
MD5

09a0f413e35de6e4a6a1c719dbb161d1
SHA1

6d10103f5d0ae6e30ff9af49ad2c91bf8e8a0d1e
SHA256

02577dc581e6c430a65bf3dd800afb126632007ce2e4390f0d397a1d0d690468
SHA512

ed14d6ea7dcc583592c39e8c3336c8e4374267d44798522b8834f3d80550bb3ab417c81b8d585648fa86af4f66af17df2d9e220bcbdb339d85eec33a5b9b66b8
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dvrYN+4+DL/eTB/aFYM5ruOT40zdHfrl8fDQe:Qoa1taC070dDQ+H2liJ5ldd/ZscCVnFx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2992	3A4A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2992	3A4A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2992	2164	09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe	88
PID 2164 wrote to memory of 2992	2164	09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe	88
PID 2164 wrote to memory of 2992	2164	09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\3A4A.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A4A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\09a0f413e35de6e4a6a1c719dbb161d1_JaffaCakes118.exe 40396AC4ACDE38F8C375A4B2263E3835DCD5210F894CD0D558AC622505C3FAD80E9415BC9073D187AC59541B2C640300C1810BD4CE8B5CB30D718A33F923761B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2992

C:\Users\Admin\AppData\Local\Temp\3A4A.tmp

Filesize
1.9MB

MD5
a121b86b2797f3784f974f13a0b81336

SHA1
7312d613348a0176855d770fde9cc2b630caced8

SHA256
caa5b419856e0170d4d50d3a504abcf4bc2c1a040298070aca2cc7a56b89ce87

SHA512
e11baf39e0a29de7332d975f90d1fb02ea799c791b25dd412ab89a68295d3352a7dd823254565128b79c2d16470ab8c13ff3f776cfacbd3413bbb4009e6ebf5a

Download Submit
memory/2164-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2992-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download