43630bc358bb30e093bd316026f8a91b1eef3b2f8a06c2ab8046cb2434fb991e

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:05

Target

fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe
Size

82KB
MD5

fe644c81e3d41049708ea799d89390a6
SHA1

d0c5d18aee609d4b17d7138819b838c8bab0fa7a
SHA256

43630bc358bb30e093bd316026f8a91b1eef3b2f8a06c2ab8046cb2434fb991e
SHA512

bbda77dc76c0667bd75d671eca39a6b1a46e5b650896ca8642a018d54ce7a13fd6323f805fcd6246b6cb61cda117cc86c64dcd669b5a59e3af817a9b5c2d5d82
SSDEEP

1536:xeE7Ic4kqhsQgcI9SU7VCUNtVAXjMuYf7vNRh:0Hkqhs5cIQU7VCOAXIuYf7vrh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4292	4064	fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe	84
PID 4064 wrote to memory of 4292	4064	fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe	84
PID 4064 wrote to memory of 4292	4064	fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fe644c81e3d41049708ea799d89390a6_JaffaCakes118.exe" 4699450863434367338
  2⤵
  PID:4292

memory/4064-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4292-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4292-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download