76c3ea6223608c45717f66b047302da0d44bd51ebe15201739afa419942808e0

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 09:10

Target

f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe
Size

1.9MB
MD5

f570fe74378677c973f845d0d00218c7
SHA1

2614de619f42f3fac7e6a26d1febb0159b2fec2f
SHA256

76c3ea6223608c45717f66b047302da0d44bd51ebe15201739afa419942808e0
SHA512

d78718bb205253e039bcda9d0bd37e8e3891839b35db56d890905c9eee2e71ea9b06855b51babe97f96c7bc1f121167d8b708ea61457427bc2ef0798e8c8bd27
SSDEEP

49152:Qoa1taC070dMbr2s4oFrH9sWWYQJWoysFTKMK:Qoa1taC07br2sZtH9sWhQJWgFTtK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
452	3B53.tmp

Executes dropped EXE 1 IoCs

pid	Process
452	3B53.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 452	1600	f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe	88
PID 1600 wrote to memory of 452	1600	f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe	88
PID 1600 wrote to memory of 452	1600	f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\3B53.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B53.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f570fe74378677c973f845d0d00218c7_JaffaCakes118.exe A2A13865A3CBAF87935E235BC6CA793942FC4F8C5EB9059874A1DDDECD6D9DA479E557D56C30CEDB94595446716CBC6AFDDCDDC2ADC1B77D6175EA6D123693B7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:452

C:\Users\Admin\AppData\Local\Temp\3B53.tmp

Filesize
1.9MB

MD5
ff8f833352e9b3e4d7373bec3c20f078

SHA1
bac09526dba6e0db79c134f4f560f7345f10051b

SHA256
c1e5279f3f3a1409b38740796a354574afd0195c88f728c428f5a82f2a033600

SHA512
5a9747e7fa587e6793d95fcead29ed45f4151a34f60ecb392a1d4a0a9e2f9a9855b1e114119a33added65f1de44d77ec745d8fbadc34fac63324ab5abc581fe7

Download Submit
memory/452-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/1600-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download