07fa7cc32653d99f81d4bc4c479a19528486643c3ae238de9614af9dd93ca68f

Analysis

max time kernel
91s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 10:00

Target

e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe
Size

1.9MB
MD5

e1ff12325b19dca11adab02b8059de8a
SHA1

7f97d77be09994cb3025b6ef2f29a479d7db957f
SHA256

07fa7cc32653d99f81d4bc4c479a19528486643c3ae238de9614af9dd93ca68f
SHA512

b8392a83de4c8afe23d95f14bca5ef0fd9bd1d6daf1866122c0d3692ecb573f9a1c426e547dd861e3833d9147078ed3dbe01e4e4986a6ed233a3c0b3107b2d80
SSDEEP

49152:Qoa1taC070d/mBgrcJ0PTPOYqHHtBj0uc+hJ+lFo+idlc3k:Qoa1taC0rBg42PTPpqHNBLc+oFmdlCk

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2128	4AD4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2128	4AD4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2128	1096	e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe	89
PID 1096 wrote to memory of 2128	1096	e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe	89
PID 1096 wrote to memory of 2128	1096	e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\4AD4.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AD4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e1ff12325b19dca11adab02b8059de8a_JaffaCakes118.exe 8491383885276436103EB3FA8DCFA4DE2095FD009AE441C1DF84DB795E02C9727DBC7730929CC97FEEF5EC5298147768A6CF518B2C20C32BFC2CE677A66B9E22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2128

C:\Users\Admin\AppData\Local\Temp\4AD4.tmp

Filesize
1.9MB

MD5
474d3855ba21c8c91a3290c99d150933

SHA1
c61db2a34b5dd3394923ceb935e3b86138ac3dbc

SHA256
20009e4c48357f3b3bfb3151b079fc5e88325657725823f31543f9bba02b9856

SHA512
76f8286884cfd6728a1660c1ef8f648bc66e0f64fc92f27adc5a2c4540ee93871ed724680a803ef93becfb66de0517c5c371243938ad2f57d01dd3a978d371ac

Download Submit
memory/1096-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2128-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download