6486cdbd901a4595d90df7e9dc46277f7c5aa848640b417deccde8032941472c

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 15:21

Target

f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe
Size

1.9MB
MD5

f848c5209d9b8fdacd6aab6cc731dfa0
SHA1

89edd7b870fda72ccf8bc8eaf4c27585b1660fbb
SHA256

6486cdbd901a4595d90df7e9dc46277f7c5aa848640b417deccde8032941472c
SHA512

628b46ffb9c11be20790af8b9e24fba7b98034bf8da41c2c5e7f823f9f15afccea4694526d5941111502c31dda55312b5e8a336c45ec9ac1ce07c1b121e73c73
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10d03lDn7dovtwdzHRizW2nzj+H3oxnERE/qNPG:Qoa1taC070d0uvtYbRirz/mUqNPsb

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4484	3160.tmp

Executes dropped EXE 1 IoCs

pid	Process
4484	3160.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4484	972	f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe	90
PID 972 wrote to memory of 4484	972	f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe	90
PID 972 wrote to memory of 4484	972	f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\3160.tmp
  "C:\Users\Admin\AppData\Local\Temp\3160.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f848c5209d9b8fdacd6aab6cc731dfa0_JaffaCakes118.exe 6EAB77892B12FBDD3EA0B31E094F37EB88F4BCFDB5E6D1246CAA1578FAADADEBB9A4A81C895B3274F19BF06AFD171C1B36024D4503AA9C567C14E0F1993E8F63
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4484

C:\Users\Admin\AppData\Local\Temp\3160.tmp

Filesize
1.9MB

MD5
7f7eadf42aeffc2a2dd120872c6dcfce

SHA1
4fe0b6dbab0abfb9d86123814b7567552cb02152

SHA256
df021d090dcf16c50c6ee46a655f7628b0710625e8df27f30ae120375ef3a592

SHA512
28c0248fa43719bda409d72a1e9f72b63571a14ec718d5fadccfc39d57e631bb75feb03f1d5bce9c984694dcd2ebcd6419434f057733f76e914ea88478f1d9fa

Download Submit
memory/972-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4484-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download