7413cf7d8458ecca52262330a2c186228d5b6d4e8e3a85844f18ef46c138b7ef

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 07:34

Target

f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe
Size

4.2MB
MD5

f300cdd072d3a15facba6701f5ec233f
SHA1

8d6df69373f9788699595dd5563658c2fd58c253
SHA256

7413cf7d8458ecca52262330a2c186228d5b6d4e8e3a85844f18ef46c138b7ef
SHA512

2418b262783419fba87dd94fb8fc1bf25cfbc6f14774f4fd6cac21252dbae4fe6a5f81f64de1e4d4ebc03c91f77e84a4d9f81d55420074aa4497a6573de21cbc
SSDEEP

98304:emhd1Urye5cGGDk48yOqyG/SVLUjH5oxFbxCVLUjH5oxFbx:elSGrPZGaVUjZEdCVUjZEd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
644	6A14.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 644	1580	f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe	90
PID 1580 wrote to memory of 644	1580	f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe	90
PID 1580 wrote to memory of 644	1580	f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\6A14.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A14.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f300cdd072d3a15facba6701f5ec233f_JaffaCakes118.exe C9ED0BF841A530DE8B8E96E336E7BDA08A1DD6A13C03901487B244E55D340369800F138716FE6F25C88EA764B873FFBD9FCDF072BE03022AC1A1CCB89D7D3E46
  2⤵
  - Executes dropped EXE
  PID:644

C:\Users\Admin\AppData\Local\Temp\6A14.tmp

Filesize
4.2MB

MD5
ee10ea02ff70de1208546ce1a59b4cee

SHA1
56beefd391c677d52a37be4c7e77d7e79a4ac849

SHA256
77f1ea82bb30c34f7260d1bd92637894500be8cc2a2e5d990df7a07a04a48b4d

SHA512
7c1bdd1bef8cd0f75ab4a3452ce5b2cdd52f37112e737be0c02028dfcf22ec5eace0ea17c484e975a0abf90c32acd6bfb68729f086f16eb0709af55ba6ac2cab

Download Submit
memory/644-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/1580-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download