8572a8b421f62fd581cbb88cfabcaa057ff2605d257fe1ea5fe636fe166f77f2

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 16:25

Target

bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe
Size

1.9MB
MD5

bcfbd6db4f720922a476b74b1ddeec43
SHA1

d547f131c6b56ebff695cd65e10ecb6548fa5c3a
SHA256

8572a8b421f62fd581cbb88cfabcaa057ff2605d257fe1ea5fe636fe166f77f2
SHA512

2e8b6b7eb6bf9719cd39c5a728ac60b96de8296ce6177a9c765c43fdbb798132f2053e84a486af2d46f1b2454568523735406eacb98e6730131e5ff663047560
SSDEEP

49152:Qoa1taC070dD2pwT7WAFyWSBBpnt1kYMD2Kip2/r:Qoa1taC0/Iy9npnt1dM5ip8r

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2960	6B7B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2960	6B7B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2960	1520	bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe	88
PID 1520 wrote to memory of 2960	1520	bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe	88
PID 1520 wrote to memory of 2960	1520	bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\6B7B.tmp
  "C:\Users\Admin\AppData\Local\Temp\6B7B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\bcfbd6db4f720922a476b74b1ddeec43_JaffaCakes118.exe CDFB49D4EC75C00D630009AEB20831C25733E19A3C4A7E4002451B7FF95ADD88FB896AF7162C7C6E529A936C5B85139CE98DB8829C7C463F2AFF410FEAD9F5CE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2960

C:\Users\Admin\AppData\Local\Temp\6B7B.tmp

Filesize
1.9MB

MD5
e0608037c2327ef9fcc4eb9f60c6c58c

SHA1
03eef17bbacd3aaa40c3fb2f64eb0f5f276f783f

SHA256
8b61dc9ad05a0370ee3a96e068abc87de9e36d11e200bad30d33e2536b9eebdf

SHA512
1453eaac08e8385c9457e9a5a8f5b150110c4e2354c329a1814c59da316a7ddda0ddd335de2928da36a7d59e49077dc25e92e8358d6f515eff80afabdcaafbdd

Download Submit
memory/1520-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2960-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download