158c6381a64c4f81b4ce4b606320300ab203c5fa8b4482ef77211c86a0f7de1f

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 03:13

Target

c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe
Size

1.9MB
MD5

c93c290d7cbd243ea5426cf23f502032
SHA1

ba9d47eed9c651d3801969c7dec37862caee6a90
SHA256

158c6381a64c4f81b4ce4b606320300ab203c5fa8b4482ef77211c86a0f7de1f
SHA512

b9df2347992afc971910f0842dc0d00fecb40be3878b55c3f13f23facb24d76c2ad491d53d97e14f8e2865c1d2cd13701977bf6feb2fbc042c87f6dc4c042817
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dZKIjH1V4pvRX94EeJp2S57+6jIEhrVbzAlL:Qoa1taC070d/72vRqEq2S57+68qVML

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4708	3846.tmp

Executes dropped EXE 1 IoCs

pid	Process
4708	3846.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4708	1696	c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe	87
PID 1696 wrote to memory of 4708	1696	c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe	87
PID 1696 wrote to memory of 4708	1696	c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\3846.tmp
  "C:\Users\Admin\AppData\Local\Temp\3846.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c93c290d7cbd243ea5426cf23f502032_JaffaCakes118.exe A88B88A0726972D29B315D1A6A36083B1DF484595F937AAB34F4BD438B14620E224E1AFD29B385EDE37FB229D5BC5CFEC86B17C922BD27C0BECA99C6D28C3AE2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4708

C:\Users\Admin\AppData\Local\Temp\3846.tmp

Filesize
1.9MB

MD5
2b1e9b4a5810df80fa7f805710919985

SHA1
af223d114a0e32ab54ae5f834b9d5753e5421712

SHA256
4a3e38046fdc377fae996147ca02dbc9a3a6972168880413906a14ee538deae8

SHA512
72a33dd8aa0f7de2dd0dbb050a5673f136c297c64f9f679accbd72bc68fa7953ff0937e41d133af777a1b837d4e116e235141b926240947fc569adfd27e721d7

Download Submit
memory/1696-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4708-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download