0a7b71e5435ad7bb7f65e4f11fc62bed43a4abe6f8720666226bb31793c9cced

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 15:25

Target

258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe
Size

1.9MB
MD5

258d7cdfb4ba37539c621be07b85ccfd
SHA1

dea70d71347da465fe623cc6f18c6dc0e41ee968
SHA256

0a7b71e5435ad7bb7f65e4f11fc62bed43a4abe6f8720666226bb31793c9cced
SHA512

1e4bea8cf5af23f8ff6584535d07a16339d4bdeed2dfaceb72407d0d290934dc49254b3f0047185a4c9ae6b38531a6902bc27b0c3bcbfce79deb065c23608c5d
SSDEEP

49152:Qoa1taC070d+aaS0frs+8mKSZoETQMbi8ueJScziD:Qoa1taC0NaZCt/wSm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4896	3539.tmp

Executes dropped EXE 1 IoCs

pid	Process
4896	3539.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4896	4156	258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe	88
PID 4156 wrote to memory of 4896	4156	258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe	88
PID 4156 wrote to memory of 4896	4156	258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\3539.tmp
  "C:\Users\Admin\AppData\Local\Temp\3539.tmp" --splashC:\Users\Admin\AppData\Local\Temp\258d7cdfb4ba37539c621be07b85ccfd_JaffaCakes118.exe 5BFE251837A7113AB966A4394C8FA94EC1FC7F452FEAE117D37CF669535DB92C8F2B2FB1D2BBE7FEDC977EA7B6F1552BEFBCA030A1A96BC323B8B9D905B1CF4F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4896

C:\Users\Admin\AppData\Local\Temp\3539.tmp

Filesize
1.9MB

MD5
d7e49efa9666cd4a53df5769a58eab56

SHA1
e13dbb71bf463da2430c22204ecf89af99e43fd6

SHA256
790aea726ffb9cc3a7c900bd73aac9ede88a284acc640d8f470a8bda5f870e99

SHA512
584b589bcabc5c1a6909c9413e2be3119a9083b0bacaa358a7790a4e57f4b0734056cbf2101faa3f19e4f37d3394ad46d06a406101dc60a2c48e371cd05f0cb0

Download Submit
memory/4156-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4896-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download