8a68f6fd7102c400d1ec1af36a677e71eef85cb0984d938208d3abe40308b17e

Analysis

max time kernel
92s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 18:08

Target

291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe
Size

1.9MB
MD5

291e6c614b7b47697f7814d6170f4a1f
SHA1

fc93ffcb361d79d568b4ebe411d51d30bb32fa06
SHA256

8a68f6fd7102c400d1ec1af36a677e71eef85cb0984d938208d3abe40308b17e
SHA512

315b5eb1b72661aa12b1b2d9f777365c6d4c10cf49a8a31293227fba0c87d486fd5ba8f173e9fdc48098b83fa3fd8c8d81d4888eaafbf4a8fb44bbe3be6a7174
SSDEEP

49152:Qoa1taC070dT9mGl17s1eQhsiMqcGU57XL8iOM:Qoa1taC0Qs1eQhdovOM

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2360	3B24.tmp

Executes dropped EXE 1 IoCs

pid	Process
2360	3B24.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2360	4372	291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe	88
PID 4372 wrote to memory of 2360	4372	291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe	88
PID 4372 wrote to memory of 2360	4372	291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\3B24.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B24.tmp" --splashC:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe CC5A1C5727FD407E910EE85A1B4BAA00025D3C4FC6CC8A9D005D80D40B67076D6E03ECA47660C1FFB5B4D3A67D0B0AC959FDFEC3489A75C6193A80F4AF4E8F01
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2360

C:\Users\Admin\AppData\Local\Temp\3B24.tmp

Filesize
1.9MB

MD5
0a90c75716b21dae826c8a3b03fe69c8

SHA1
da47dbeaf07125313823c105e9c870bf87a3017d

SHA256
42e0f7dfaddc720f7e6612f5d333dd8951a4ec771818513dae7a7b36448e8584

SHA512
d22e95fbd3fa0326e6a5de7f6eedc21c6833065e1064f8d262b4912bc5a29ab1fba8591e165e5071fb3d744387cd116907e7bada98b718c6247a10acd254e8b2

Download Submit
memory/2360-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4372-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download