704a72a057ff6d2b157fec07125a446d19a655b7236ade81e78443e11a1c390e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:30

Target

c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe
Size

1.9MB
MD5

c71bb0736139d20c0f87e015eedf4b42
SHA1

c7d1afe6060cb72a5a942c62025969f5dc27febd
SHA256

704a72a057ff6d2b157fec07125a446d19a655b7236ade81e78443e11a1c390e
SHA512

104df2c5bb93f73c9b53f6bc3a653f1521a5e0ac825853ba2d6040608f7998aeb6c4fb94d3fadb5a6b997560249987357990498e2c54d32ded5f842625aff6f9
SSDEEP

49152:Qoa1taC070dhwFBhQ0X5SGUfYVQmxIdvT:Qoa1taC0dFA0KY2d

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1584	3827.tmp

Executes dropped EXE 1 IoCs

pid	Process
1584	3827.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1584	2444	c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe	87
PID 2444 wrote to memory of 1584	2444	c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe	87
PID 2444 wrote to memory of 1584	2444	c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\3827.tmp
  "C:\Users\Admin\AppData\Local\Temp\3827.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c71bb0736139d20c0f87e015eedf4b42_JaffaCakes118.exe 7D1228BE23DA56440672699C89D328003832CA5749A9AF4C74ED9910F168F07A0A3F2E370C9229F3C14B450EA243C3C688E4FE331E23C56F6751E74B4C76F81A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1584

C:\Users\Admin\AppData\Local\Temp\3827.tmp

Filesize
1.9MB

MD5
07b87ab142e221a5489051fa0a8f7da7

SHA1
585f81906fe34836cb1a6f4b8a3ff8bd1f00340a

SHA256
99bd45da1ae72632140a349726b5d082955303741ea292ebef8eca4937da1118

SHA512
9c0307ff390c9f6a3e623a863b8ba11666a9a80d3ba4e179503c9670d133a54778a9267d9d52749ad889a82e90a9d11d37fbefacbdd78e0249e2ce45a86572aa

Download Submit
memory/1584-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2444-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download