219e06a778e49dc9b02bb2d460e3d379d9aa9265c1dd506befe4fb500eaf3e81

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:52

Target

ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe
Size

2.9MB
MD5

ea3dbe6cf6a414cf5ef16f02bd8cb3bb
SHA1

fb54b2de88400a821e6fc4e1590f535c2d2445c7
SHA256

219e06a778e49dc9b02bb2d460e3d379d9aa9265c1dd506befe4fb500eaf3e81
SHA512

ebfd813dff9c73433ca2e66543fcac4b425a60242a00f66a2f933df4fb63ed1aa6e3dc3cdecd4cb81f8e1e3a7c5a292d95d0e1c17272bf7f02a5c5602f72c759
SSDEEP

49152:q95wS32qlIBVHZ26G2EnkS0pKNUpEnGHEgT+bWlqZRd7lEbuzWp:kD/lIjK2EJEMukgUfd5EbuzWp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1032	ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1032	4984	ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe	85
PID 4984 wrote to memory of 1032	4984	ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe	85
PID 4984 wrote to memory of 1032	4984	ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\is-I3KOH.tmp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I3KOH.tmp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.tmp" /SL5="$7011C,2698796,69120,C:\Users\Admin\AppData\Local\Temp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:1032

C:\Users\Admin\AppData\Local\Temp\is-I3KOH.tmp\ea3dbe6cf6a414cf5ef16f02bd8cb3bb_JaffaCakes118.tmp

Filesize
703KB

MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
memory/1032-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1032-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1032-16-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4984-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download