36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 09:36

Target

d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe
Size

1.9MB
MD5

d0121aafc70d2e972ee1d23b3460a856
SHA1

2d2015fae69a934832da394d27e93366d5a68b67
SHA256

36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64
SHA512

d9f7adedecba0c92adc1fd0f36627edb313bc4bf3031c9555e3541fb47d945ae4eaf000ed7f3894a0adda5bb37548c6cfda5d5ea3b3d23c2737d4824f44cf3b2
SSDEEP

49152:Qoa1taC070dpTubkoDGaXoJgPCzB6J2KZ:Qoa1taC0kfMsu

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1192	4083.tmp

Executes dropped EXE 1 IoCs

pid	Process
1192	4083.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\4083.tmp
  "C:\Users\Admin\AppData\Local\Temp\4083.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe B0D73B3471D1253F98D8633594D5C9392D8BF8F9CCB2488A4AE2C3345A60A3D4DC7C0EE0EDFB1778773F47C3389E8180C3662DE6AEA6993923AC54A25F3DA49E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1192

C:\Users\Admin\AppData\Local\Temp\4083.tmp

Filesize
1.9MB

MD5
99be2eff4de49c5bdae289f916f5124e

SHA1
8baecd818efe0648967c3cb60344c234f03ea386

SHA256
c77c15852e999a4739237085063f299682311235e31c5cc32a3e19a87c4dee87

SHA512
48ab986b3bb60abb6d1467f4dc14460e06666af2d83e17df872f817bc17dd1e9e14a75842b825478437988757370bf936fd7984531018aa1ba0adb46f38cc373

Download Submit
memory/1192-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4324-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download