0ddb94e0d671a046786e2e4890d21eeee3b75d0822a0313780094f0a50870383

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 09:24

Target

f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe
Size

1.9MB
MD5

f7b5eeb7fee246944fe81662b2441e4a
SHA1

5c972761dfa228aed6fd8aef95886898820c76b1
SHA256

0ddb94e0d671a046786e2e4890d21eeee3b75d0822a0313780094f0a50870383
SHA512

9111e881800eddc9669a68f9255c90542ef9912bd57e2a7a71b1b998f749311b69dc43ea27a71552428780081269579b7b31422b1679b179af682198fd509724
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10d+g28a/NNryebJlapPYvRnyu4AJAxGAraEWSH:Qoa1taC070d+gAXcQZnd4ASh+EjgtTSZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
332	6477.tmp

Executes dropped EXE 1 IoCs

pid	Process
332	6477.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 332	3204	f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe	89
PID 3204 wrote to memory of 332	3204	f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe	89
PID 3204 wrote to memory of 332	3204	f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\6477.tmp
  "C:\Users\Admin\AppData\Local\Temp\6477.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f7b5eeb7fee246944fe81662b2441e4a_JaffaCakes118.exe 5B66D27180B9792AA253F838AEAAC0A8E43DCEB505064A9E9A03F9130A6EB06EDFF824D58B932E9D35BCC258E5CAB806F26F13698017A7E8D5BC868E57B9A38C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:332

C:\Users\Admin\AppData\Local\Temp\6477.tmp

Filesize
1.9MB

MD5
7059c0b89c04f54552faf5bd4934149c

SHA1
fcecc55c8e6837b54499c0a04877d96c9e586099

SHA256
7104315833125d7080372b0be264355ba2f972afa70c7341d4b8215575d6b27f

SHA512
aec3019d2296170d1ee7e4cb19656c77b7898d67c5bc7018eb0161c6a4d686ccb72b834eef52838e13804db2ac3e9a66abc357beb81b0677a329034f96dfcf99

Download Submit
memory/332-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3204-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download