68c019d645f21f1ee98c79f489feb5b617aaf0d41da6d0b79aeb6a8e8410cc90

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 18:11

Target

bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe
Size

1.9MB
MD5

bf42db5a50531afe0262014479fe50fc
SHA1

cc9edd37e677a0fce501abbe336255ef1bc4c651
SHA256

68c019d645f21f1ee98c79f489feb5b617aaf0d41da6d0b79aeb6a8e8410cc90
SHA512

9636f9ebf38db64e49b51e805ee6ecae9879f1d7c53ef6df0cb0ebe251d3ba4efd414b7853da32d23f53c02152f1e70a2a352063a3a31f3b18c2a8f24120be12
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dqEe81o60blXqRwvjnoWNWfB7J+CEB2QC9LJI:Qoa1taC070dne81XrukWYBvUPeLQL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4288	42C6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4288	42C6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4288	4072	bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe	85
PID 4072 wrote to memory of 4288	4072	bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe	85
PID 4072 wrote to memory of 4288	4072	bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\42C6.tmp
  "C:\Users\Admin\AppData\Local\Temp\42C6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\bf42db5a50531afe0262014479fe50fc_JaffaCakes118.exe 5B5E1BDC932E5F95AD325D3D870892E1F437B22605393B0B05F9C75F6953211B080E7EE0D25D5BED343B48CE2A4A8D4E4089562AD73ADD54047A7806D7C2AB21
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4288

C:\Users\Admin\AppData\Local\Temp\42C6.tmp

Filesize
1.9MB

MD5
2210429f4aaace5929f1c22cba4b8689

SHA1
6382a024e46f48624c6bd709e568e33df8c80977

SHA256
e053d1b7be2f601c238dea208558c3439a506fb645774a1cb1389f943155ffa7

SHA512
564fa6089aaf83aa12264a878ea3199d830fd5f59ff79df91b6f1ab66937dc115d3913344a2b193a0dcfd18df875b518f9e66f2f972de17489a38c9ef122e2db

Download Submit
memory/4072-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4288-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download