053802325bf2e1e43e70b90fb3ef16f38cccd17ce345405046b60067c82effc1

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 14:15

Target

2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe
Size

1.9MB
MD5

2429ff39967f380cd2b62ff61c38f262
SHA1

55d84816b9ec19fdc5afd8e6f0b258e08dd1754c
SHA256

053802325bf2e1e43e70b90fb3ef16f38cccd17ce345405046b60067c82effc1
SHA512

e98bc97396f959e7380094f15d2018b74e2f041a934d5f138e708a2cb91991d71d1792e579db884055e2db622da89e38734dcf4e68fdc9346abba36993df0487
SSDEEP

49152:Qoa1taC070dsgMNQHBXhJHoD5DYtLLIL4+jNunqYkG43:Qoa1taC0YMUHoDyL+j9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4840	49AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4840	49AB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4840	2472	2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe	85
PID 2472 wrote to memory of 4840	2472	2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe	85
PID 2472 wrote to memory of 4840	2472	2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\49AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\49AB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2429ff39967f380cd2b62ff61c38f262_JaffaCakes118.exe B0C387070A7019546E53AAAE47AF618EF921C9637CF0508EFEB75FD477E92401C0B6A9B404DE8E319A70CBF21080F0DC3565CC221F32C3D40C8DF40DA9E67FE8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4840

C:\Users\Admin\AppData\Local\Temp\49AB.tmp

Filesize
1.9MB

MD5
fe7b08ef98dd5f1a6457d84733a760f2

SHA1
f959e5c850fde541ee7a1b937b322356af315dcf

SHA256
322db8fcc1e2a938a86b47017ed4e22a5b304c02b888dc8df5424e919015fda3

SHA512
37503213910d17a4ff355bc45ced41fad8c094b06326e965b9a4541ba089973480ff6b4af6b8ae84d784b3eef592075220ea6e5fbf247e3d6cd22542630bf58f

Download Submit
memory/2472-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4840-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download