42e6a9531d3f5791c71b39f390ec2dbabba6e7ba69c0d384905cc2f84de2d455

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 07:55

Target

1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe
Size

32KB
MD5

1cc334d6973ac112c643d594592f6789
SHA1

0cd17d0a796abc71e9eeac5325f178a56f8f42e3
SHA256

42e6a9531d3f5791c71b39f390ec2dbabba6e7ba69c0d384905cc2f84de2d455
SHA512

c38c84e4cb5bceb9c2461a352c6e12a1c10ca9efc4ce8079f37cfd023d8464d495347a6789d153736f69edef7645526b4c427a2ea96535581a9dc417e7c44d82
SSDEEP

768:xPrCXibnfts+yJAloJB9KFplCGRWunldTV:FrCXibfyHAloJyjlCGpj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2796	116	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	95
PID 116 wrote to memory of 2796	116	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	95
PID 116 wrote to memory of 2796	116	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "/sihost32"
  2⤵
  PID:2796

memory/2796-0-0x0000014C42950000-0x0000014C42957000-memory.dmp

Filesize
28KB

Download
memory/2796-1-0x0000014C42CD0000-0x0000014C42CD6000-memory.dmp

Filesize
24KB

Download
memory/2796-4-0x00007FFEF9C50000-0x00007FFEFA711000-memory.dmp

Filesize
10.8MB

Download
memory/2796-5-0x00007FFEF9C50000-0x00007FFEFA711000-memory.dmp

Filesize
10.8MB

Download