74d7a27456183d940e53cb89d636872c40e844572a5b6265af6385a46ea1720d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 13:36

Target

235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe
Size

1.9MB
MD5

235ac81c73c0158cd1e283f84a1cc213
SHA1

9dc3ea6b9f476f842c5ce6a6de6e3193dad02daa
SHA256

74d7a27456183d940e53cb89d636872c40e844572a5b6265af6385a46ea1720d
SHA512

12c66a80109b4fc7e65569416a85822262661c73707076a2007279be78ba068b0c2c989b44109410c47960252d4dbac5a708cbaffc740108661a9d6bfb530661
SSDEEP

49152:Qoa1taC070dHFsu4mIKuwIH/GlYjgqIC0:Qoa1taC0suNHeNqIC0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3492	3F2C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3492	3F2C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3492	3608	235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe	89
PID 3608 wrote to memory of 3492	3608	235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe	89
PID 3608 wrote to memory of 3492	3608	235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\3F2C.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F2C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\235ac81c73c0158cd1e283f84a1cc213_JaffaCakes118.exe C351728BEF3C233E11EB68C5B3488D32D80DCC61CA2E7FAE1DE42AA4F6D385BA5246ADEA1331989763F24B8B0FF0C477A2AAB4EF125F009CF8F8FA393272CB68
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3492

C:\Users\Admin\AppData\Local\Temp\3F2C.tmp

Filesize
1.9MB

MD5
906b86789f6575511fbbf35e44e8010e

SHA1
b1bc5d043b64d9ec064521f92e1454c0847d0c82

SHA256
32c432b3a980415b40f45abdf6f6241140f247e5a19984b0278b61521e63e4a9

SHA512
389aca518370722202aedd05a2b949f1a3417b32bbb52adb22ae4a63100293d31376e59af888599b3e8dbf761dc798ad1a755c0de41a7048488cabafed5fa96c

Download Submit
memory/3492-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3608-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download