2055fdd6e693d528617f09bd1bb6cef2da5b732b128722f7ae35f7e6c5ad2347

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 03:09

Target

16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe
Size

1.9MB
MD5

16e09086c9fc8937a7aecb4e96ed4ff1
SHA1

050bfcd3f30339a3f67c8798b62f8d02f4fb97ec
SHA256

2055fdd6e693d528617f09bd1bb6cef2da5b732b128722f7ae35f7e6c5ad2347
SHA512

d21aa824da190042f50d4396669733b546112a28c68b28d2a80dd847ac5f96d6a401f213678b231fd182c316c985c557b1bbd85f0b21bd59a13201fd5d6d8d2c
SSDEEP

49152:Qoa1taC070dRjZueX87EjmY8kScDr4d6iIk:Qoa1taC0OnLrBboRIk

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4876	4B41.tmp

Executes dropped EXE 1 IoCs

pid	Process
4876	4B41.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4876	2900	16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe	88
PID 2900 wrote to memory of 4876	2900	16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe	88
PID 2900 wrote to memory of 4876	2900	16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\4B41.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B41.tmp" --splashC:\Users\Admin\AppData\Local\Temp\16e09086c9fc8937a7aecb4e96ed4ff1_JaffaCakes118.exe 10767DDB36005C45880F7D03D99931C7A1E839050259A36DD63C5CDD52567285269778A742E8697841E559FFC1FB5571BC45B971ED17858E3F2691D95B46F091
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4876

C:\Users\Admin\AppData\Local\Temp\4B41.tmp

Filesize
1.9MB

MD5
01ab6474f1b27f0b07ff3f03f75625aa

SHA1
7bc9c15e9443cf3ccb18028ac5417a63187e0bfc

SHA256
41ab8e7f043f5a3624134cba52ce45848110cad75e389fe65d0be10f974d86f2

SHA512
85ee5b9710cf4d5138238df0a144d0d6981c5c9b69225c01af2cb098b4b78f40075c3c8a9dbfe3ed4681f74c6adacdff204bda41d22eef54b7f625822f78049a

Download Submit
memory/2900-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4876-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download