f7de1afaad1a9fcd00005e07bf228d304e4a0aa690852dfc1b0ac637e940b97c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 02:54

Target

c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe
Size

1.9MB
MD5

c8d82f04af1b005ce3e09adc0ea1af86
SHA1

4854a81ec487342cfc5dcc1ba15b71ebd55c91a1
SHA256

f7de1afaad1a9fcd00005e07bf228d304e4a0aa690852dfc1b0ac637e940b97c
SHA512

e90baf9ec99304f1dc2738b5fe97faed5e4aa772a08c545d0a78089fedf33d7ccec84e5fadc10a6fae2f0bbd7fa2400a54d906359011abec22c01c8d3f4c0991
SSDEEP

49152:Qoa1taC070dn2qVzvZpYioUiPef/bcmis7qhhuP:Qoa1taC0S2czDYjUiPWJ7q2P

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3108	2FE9.tmp

Executes dropped EXE 1 IoCs

pid	Process
3108	2FE9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3108	2332	c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe	89
PID 2332 wrote to memory of 3108	2332	c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe	89
PID 2332 wrote to memory of 3108	2332	c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\2FE9.tmp
  "C:\Users\Admin\AppData\Local\Temp\2FE9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c8d82f04af1b005ce3e09adc0ea1af86_JaffaCakes118.exe 4E629A99152D6E9406FAD3209E71F0FE529E33A4A2BCBB937A0C76E2BFA7AC5AD5930B4DDCF7774AB3E7C9981814F780068763A7D925D1B0C2D337A9472C5895
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3108

C:\Users\Admin\AppData\Local\Temp\2FE9.tmp

Filesize
1.9MB

MD5
1b111b35ce58b79538e1ea2fd9826317

SHA1
beb4b69aabe9a8af6ce1f9ee4d16bff006171bc7

SHA256
1354f25e08d29ace5309f5899e75bef66dcaab75a8d5cf14c513d01390599594

SHA512
b2cc1bbf702af2e7a49c21bf03eed125cdfc00c6f2bee1587d9705e8db175391961018146c344c84fdbd495935120d1c9034b916942e6aa828afc1d644bc0aca

Download Submit
memory/2332-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3108-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download