717d9e957c4e1ca9953dec3c0e4991ce928d4d7489fc80ba5ea2cd53738f9c0c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 00:18

Target

fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe
Size

1.1MB
MD5

fdfc3b054e2f3bd7a5186e43de565c26
SHA1

d6dffd64cb99e2caba6e54d9f00d874f6f05e3e0
SHA256

717d9e957c4e1ca9953dec3c0e4991ce928d4d7489fc80ba5ea2cd53738f9c0c
SHA512

a6d3e10f0b80d1aa87443f8287c2ea6eb3c706ba482fad6e6a1b79f7ddc634806d2c0889e66af8f57805d9c12f7a0c4838a031e7a2d5544f36fde9ce00bcd342
SSDEEP

24576:SypW9SgLNZaOdcTMuUvxIgrQYTwsF0shVgmSIAmnXjvCcnTQknqCrJNU0M:St9SgLNZa6xIeTesbTAuuivqCJM

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4424	D060.tmp

Executes dropped EXE 1 IoCs

pid	Process
4424	D060.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 4424	1356	fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe	88
PID 1356 wrote to memory of 4424	1356	fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe	88
PID 1356 wrote to memory of 4424	1356	fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\D060.tmp
  "C:\Users\Admin\AppData\Local\Temp\D060.tmp" --pingC:\Users\Admin\AppData\Local\Temp\fdfc3b054e2f3bd7a5186e43de565c26_JaffaCakes118.exe 37DA17FD14F514B8A97D17D501319AB684CD42EA154C0683D150AD65C2D29AA11108F3848F7A52E7635BC983B975DD4F9F3E6E06DBBBE988E0F6348C18E5EB72
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4424

C:\Users\Admin\AppData\Local\Temp\D060.tmp

Filesize
1.1MB

MD5
e4c09e9b91981f7dda2538ca7e256514

SHA1
123339d0938e8d8b96431e1968fe70ca1e5e8b5d

SHA256
1da5436ef586a13ed29ba5bf8960a59b4e5e4dc97234637cc75d7d62967fcec4

SHA512
44c7730f36b4e54ff55360217b66e3467ad3bf7ca0b11e3ad241e2ed5353523854bfc583d639ded7b4378e980fe3c0b2c5c82ffff368ba18eb54b6de5a265394

Download Submit
memory/1356-0-0x00000000005D0000-0x0000000000715000-memory.dmp

Filesize
1.3MB

Download
memory/1356-1-0x0000000002790000-0x00000000027E0000-memory.dmp

Filesize
320KB

Download
memory/4424-8-0x0000000000180000-0x00000000002C5000-memory.dmp

Filesize
1.3MB

Download
memory/4424-7-0x00000000021E0000-0x0000000002230000-memory.dmp

Filesize
320KB

Download