321832fd912f1d551238f94564c966e2f96062ee6bc503d786ea1dd2f25be42c

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 17:47

Target

da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
Size

1.9MB
MD5

da8eb62581ee73caf1ce481aa1202d08
SHA1

a7fa12e3ce22765b4b4d72b0d698bd998a456132
SHA256

321832fd912f1d551238f94564c966e2f96062ee6bc503d786ea1dd2f25be42c
SHA512

f4ebcffce40b99f8b7f0f0651f9c444f910c7bb19800683750dd695bbc18782c4f66ef004d4608f091492d0c13d80adce7b87d117ed6e2ba77c035244b5d97bf
SSDEEP

49152:Qoa1taC070dnWDcadX3DzFvloRxB4aZQkCbtT2wAFZWHg:Qoa1taC0GWAw3VEcbtT2Zj

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4680	43FE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4680	43FE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4680	1628	da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe	88
PID 1628 wrote to memory of 4680	1628	da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe	88
PID 1628 wrote to memory of 4680	1628	da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\43FE.tmp
  "C:\Users\Admin\AppData\Local\Temp\43FE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe A3728519FE990A4047C3ED7A6E0AE83E85AE0B02F01FB5636A96E155385146A6EFB067337B9A086E8551D9DD2932B745DBB1844A2BC283CBFE9E3989433F3A66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4680

C:\Users\Admin\AppData\Local\Temp\43FE.tmp

Filesize
1.9MB

MD5
931e0a328802fcccd4faf52d0012e9b6

SHA1
53fa7f5a589778bfcec45f442df258077f5f51ad

SHA256
12580bc962d04ae4b67d50e973ecb8aca63f23ca90135524f462a87701e7e9dd

SHA512
e1899d467500bb709677d8779d7222b24f32050c50de525bfe8f2f80e05a85d30999bac60e5318edd98d85a1bca840e4c899e8c738170c3c7277a11c6750d5a5

Download Submit
memory/1628-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4680-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download