c7bd85e1b504baf874b936043350b8ce65be310f5f57251886bc72eec7c8dea8

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 09:41

Target

f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe
Size

1.9MB
MD5

f33641cd002d6ff24db9364fb46453ce
SHA1

6eb264478503f1d36f702cd621e736ae483c807c
SHA256

c7bd85e1b504baf874b936043350b8ce65be310f5f57251886bc72eec7c8dea8
SHA512

7fe93f06834865bd7ac5d5fe7de76c70e88fed226dd9bc6de6e1f0cf8396954d0f717acd634e56e0f67c1820ddee64d30bebf3db85b9b86bdf86c644edc27de6
SSDEEP

49152:Qoa1taC070d39W3Wg3/VPd+nhCTab35VvjnJKgfU:Qoa1taC0kAxPVcCTab3fvjAR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4460	3548.tmp

Executes dropped EXE 1 IoCs

pid	Process
4460	3548.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4460	2336	f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe	87
PID 2336 wrote to memory of 4460	2336	f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe	87
PID 2336 wrote to memory of 4460	2336	f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\3548.tmp
  "C:\Users\Admin\AppData\Local\Temp\3548.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f33641cd002d6ff24db9364fb46453ce_JaffaCakes118.exe C2CC5AE0925C9F9C45081A48A71A21236A3A29C59DBD4C47BBDE1684040D10E9A7BB8AE3A54151235138D9CB8E6DBB65442B598958BF8127CB5D8DB0828565E7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4460

C:\Users\Admin\AppData\Local\Temp\3548.tmp

Filesize
1.9MB

MD5
f6579aed14bcc8bcc0c142be784d2108

SHA1
0130ea03ae18a95bb82f69d9a73afeaef2776cc7

SHA256
dbbc6c57ce7e5dd52060cd4299d2ae54aef8c344fb950d5de1fd13bbe17b824c

SHA512
38d7da97d470683c386273b411d2128d4c0baa159655d60cd29ce81b57c3f42b75724c7b903f2401f7dee11d615c5069b160ac7d023a0a8029148a990a18d84c

Download Submit
memory/2336-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4460-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download