69838c8959825cf0c825c0264ea99032b345619aaf10e76742f7cd98453faa8b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 16:37

Target

f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe
Size

1.9MB
MD5

f18124c6fcafa9b21093ee473baccf31
SHA1

ecc3b42dd4d54f1d1c165a17ed5b401858fff22a
SHA256

69838c8959825cf0c825c0264ea99032b345619aaf10e76742f7cd98453faa8b
SHA512

28545f48f11c360f97724db33fe4f223380eca99c97cfa2d61182f5947a2ed52fcc24f0313eb0aa65fdffd757c9598040af48fab9d4b9e9a82fa0a5ed2dbb43b
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dNIkBduLyHutN0kJELji2rLKqRsUVVdipBtlu:Qoa1taC070dNIIZOD0kJELjiKDRzN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3656	5B3F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3656	5B3F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3656	4504	f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe	85
PID 4504 wrote to memory of 3656	4504	f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe	85
PID 4504 wrote to memory of 3656	4504	f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\5B3F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B3F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f18124c6fcafa9b21093ee473baccf31_JaffaCakes118.exe E589C0DC7630315F93B224614715641E49C544BE12BB7704027C8B97183279C3AF4661D46D664E00E69443AD1F779649DFF320CBFAA69071D4BA9F69CC93AA51
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3656

C:\Users\Admin\AppData\Local\Temp\5B3F.tmp

Filesize
1.9MB

MD5
dc5af17ce64207902b50be299ff9f7c5

SHA1
35a3ed3fa976c21681c0df9d390f21b0e54b08c3

SHA256
2bce7c46dc747b2bd04359fd4e66884f8e0bd77cd14e8e794419bb2466325ce1

SHA512
97b761bce0acae5ac32965d08d3fef41a6f5030269dcaab79b0fd2a79da2dcf73600a088baa6044e87ecbf534e61c8ce5c398f1aaa3cfa60bd27837648d15d90

Download Submit
memory/3656-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4504-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download