de1888c8a05570a5ef225dc5c197b846d688ae41ad914365506caa2731573272

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 01:02

Target

fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe
Size

1.9MB
MD5

fe100933ce73b34723ea5f48a35a2547
SHA1

89497e494e332ed94dffe23dde6217ff4e43ae71
SHA256

de1888c8a05570a5ef225dc5c197b846d688ae41ad914365506caa2731573272
SHA512

ae73dfe84adb0f00047eeff37e298730e51ddfcaaf119d48044c72b1ccc0dff04507cf5111eeeb5bc7f6e5411fd268339ab0468bf11e297faa876595b40c4e99
SSDEEP

49152:Qoa1taC070d6hnryxBBOHmhXEbgQHi21ZW:Qoa1taC0zhE3OHmFToD7W

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3956	3F4B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3956	3F4B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3956	2128	fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe	89
PID 2128 wrote to memory of 3956	2128	fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe	89
PID 2128 wrote to memory of 3956	2128	fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\3F4B.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F4B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\fe100933ce73b34723ea5f48a35a2547_JaffaCakes118.exe 00633DC495E041724150895D08F44E40063960908FF4D162614334B8A2B11261F845C542E15ED4852DDED4E7FD126E731072D447542B0B80E117D3A10666CD1F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3956

C:\Users\Admin\AppData\Local\Temp\3F4B.tmp

Filesize
1.9MB

MD5
d5236bc7ae9f540b455295c58961b9b0

SHA1
d03691327303be8c6dc549d1db90a65178550f5e

SHA256
5903d6c935ce201e5a8c1199439626d419103f3dc85618e519d7c709cdb99e46

SHA512
c532eef0cde941f132b63732000c06e7d424284fdadea89a34d4dfbef241903b48f097abba89f70113fe209278990987a007509c56e6c6266f0d5d7db00de386

Download Submit
memory/2128-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3956-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download