7ebc64ef12c1a904ccf55156a718bb3fe555271734f85f9aa7759f482b79cd62

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 19:20

Target

0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe
Size

1.9MB
MD5

0deeb4f460b12f624a84dbc0fc2bed62
SHA1

aa984ae4288e4652411e8f996c6b5c5e2a2e91cf
SHA256

7ebc64ef12c1a904ccf55156a718bb3fe555271734f85f9aa7759f482b79cd62
SHA512

cb956f03bd78c0f7af917a83de21ac64919f645ef262fe38cfa0f0188dd3b25ddbe1896f2061d79a237fccdb71a2917ec09c65292923e47efc27eefaf7b7d0c1
SSDEEP

49152:Qoa1taC070dLcXt/PtzmUzi936hPhbFeV/fObRR:Qoa1taC0dnJmUzyQPh6/c

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4016	47E6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4016	47E6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4016	4696	0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe	89
PID 4696 wrote to memory of 4016	4696	0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe	89
PID 4696 wrote to memory of 4016	4696	0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\47E6.tmp
  "C:\Users\Admin\AppData\Local\Temp\47E6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0deeb4f460b12f624a84dbc0fc2bed62_JaffaCakes118.exe 0DA38E5E1414B526A1D7C779FD0120148678188A609426EFF0A3D44BCE9AE5FEFF089A62288B0E1F94679C641DE7004854300051F63838061349341CC8BA378A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4016

C:\Users\Admin\AppData\Local\Temp\47E6.tmp

Filesize
1.9MB

MD5
8f500d6e6cacfea45c276e239dfdedfa

SHA1
199156cd49ef0d2a1d8ee16c6e9904118c25c6f2

SHA256
8080e3ceb2a07ef676d4a7f65c0032ebcc626013aa888db0b314a652dc673bca

SHA512
106e6a89d006247de4c46f277a271a4bb42ed160fa5ce8019d7f3a224c509512691c0bb456f5e514f1bf6162446930e6c800bb9ecf65fbd9c10b4e9e7302eefd

Download Submit
memory/4016-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4696-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download