0dac0655c3f4d5e153e95570687c8a73c02ee76085c6941a1ac24b74c8b0fcaa

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 19:53

Target

ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe
Size

2.6MB
MD5

ee3794826aa3348af3be1dddb70078fc
SHA1

a410f66c0de7f2564ddf5b0f9afbbbefc6b431eb
SHA256

0dac0655c3f4d5e153e95570687c8a73c02ee76085c6941a1ac24b74c8b0fcaa
SHA512

efc170e7b6ee0226eb657622ed3a3945155f630ff5d5ae6d6e3e48429a4fcf18de30f94f58c3b592d0043acc255a6bc98efcd08ce865661d72ff0658074c4c79
SSDEEP

49152:cVM771lbLQYmrXt9HiKX/cckFz/jk147l2rw5wl8kUV1lKU/MGbEZQ/:n71uYYzfUckFjjk162rKwqkUV3ChQ/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp

pid process

5888 ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp

pid	process
5888	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe

description	pid	process	target process
PID 3644 wrote to memory of 5888	3644	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp
PID 3644 wrote to memory of 5888	3644	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp
PID 3644 wrote to memory of 5888	3644	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe	ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Users\Admin\AppData\Local\Temp\is-1NJCL.tmp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1NJCL.tmp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp" /SL5="$11004A,2361474,140800,C:\Users\Admin\AppData\Local\Temp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
PID:5888

C:\Users\Admin\AppData\Local\Temp\is-1NJCL.tmp\ee3794826aa3348af3be1dddb70078fc_JaffaCakes118.tmp
Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
memory/3644-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3644-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3644-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5888-7-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/5888-13-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/5888-16-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download