85147550b928f991c60775e6f08ce03c149def21cfda4243a58f7015fe7bc9b2

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 17:37

Target

286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe
Size

1.9MB
MD5

286eae32f0459dd5f335b949b09421d2
SHA1

c179b89582bf5b3bcf45d61ddb8dd3fff4577a18
SHA256

85147550b928f991c60775e6f08ce03c149def21cfda4243a58f7015fe7bc9b2
SHA512

cc6f6c11bf8d47a3fcb3e826daa1afa3d551cc998bc902ceae4445a3addb7ccde6ecfeb27a2e463b51ee14f55b586a1416aa6b90189613321264a2187e0298fe
SSDEEP

49152:Qoa1taC070d6zM3haUt8jV+k242hpb3MpC:Qoa1taC06AUtUgk2TzMw

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3844	347D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3844	347D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 3844	6096	286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe	90
PID 6096 wrote to memory of 3844	6096	286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe	90
PID 6096 wrote to memory of 3844	6096	286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Local\Temp\347D.tmp
  "C:\Users\Admin\AppData\Local\Temp\347D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\286eae32f0459dd5f335b949b09421d2_JaffaCakes118.exe 67A3713D48851CF05E4816AA3E37C60E6FF3080037C2519EAF394E87C6F464F41CD797EA59FC6183522E64FDAE28E5FD5B4E189FCB51D1261754BF3FFF8B46FD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3844

C:\Users\Admin\AppData\Local\Temp\347D.tmp

Filesize
1.9MB

MD5
12774fc9de9461939ebb3f7fa558c776

SHA1
b88725a65e712e7fc38c92bb954ecdd5d23eaf21

SHA256
806fe9938ea0728ef9adf03250dc7e515e2c9a34508c460b1bf454d95658b967

SHA512
b1244941c41ddb0a15ad28c0b04531c773a9f8796bd909a14fcc08cfed9397c0266107df7ec480b50d08f5b3e6ce477580071fe95750ee9b911a58184552db81

Download Submit
memory/3844-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/6096-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download