1bfb361bb63bf9bdd59d1530e487316659e691149e6ac740db0977743a94d83f

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 09:53

Target

e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe
Size

1.9MB
MD5

e9b99409fcde2123a5dd05bb763cedde
SHA1

19d92f61cdcb4bdacc808ca063114a0be4f569e8
SHA256

1bfb361bb63bf9bdd59d1530e487316659e691149e6ac740db0977743a94d83f
SHA512

66204522df742c482918bdfe99eddc9c31e19138d25bc5fdaf6e98b61c590cde2863dee02784955eb766e546104363f314f5346a2082c9ba39f0d9f8f804c1a3
SSDEEP

49152:Qoa1taC070dmzt2Z7AF98MkEeuDbrKCFRjRXYCUOF9:Qoa1taC07t2Z7M83ETbr5Yy9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2688	4575.tmp

Executes dropped EXE 1 IoCs

pid	Process
2688	4575.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2688	2992	e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe	88
PID 2992 wrote to memory of 2688	2992	e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe	88
PID 2992 wrote to memory of 2688	2992	e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\4575.tmp
  "C:\Users\Admin\AppData\Local\Temp\4575.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e9b99409fcde2123a5dd05bb763cedde_JaffaCakes118.exe 8C3804ED13D169A8C0F3CE061685CC0CA9E95517A9C377D2DBB868E1ABE7F06F18C529BB12CEBC5B7EDD802811A8573161794042D8894E5FCF88B46EFFA94C31
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2688

C:\Users\Admin\AppData\Local\Temp\4575.tmp

Filesize
1.9MB

MD5
4f2c6be365bc29fe81e36a28508b1532

SHA1
d05ad1e8cf2f764c7288eaab9690f8ffc26b0c29

SHA256
74cbffa452bea30efb1adc2f5e77019ddbba9af1d222274e03feab3d5b1482ed

SHA512
2c0b74785b94e9d7cef804da4155177c0c39662d95a6775746a4f7a36c048748e7966cf79dca5d3cab42d7313cf87cff5bf7cd2fbf2a2d555194fe3cb6c9810f

Download Submit
memory/2688-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2992-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download