3eb8928375df1bdffea5a3704702895aa87cd1e191b18dbb563536e60684e121

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 14:58

Target

ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe
Size

1.9MB
MD5

ff8aebd573993b97453855e132d9756f
SHA1

f4b4d53128eea87d3d244cf3911daf920b447236
SHA256

3eb8928375df1bdffea5a3704702895aa87cd1e191b18dbb563536e60684e121
SHA512

c73b396664cbdb2763160ecfa4446d6b5322656e4ce8af38b858e385cae5d256acfac6b6fd9a566623d70e51149d7a31b2068c48f4e2931ab00641a7e6a7d36d
SSDEEP

49152:Qoa1taC070duKXM35Wb5fsoXrZvXnLFT/ShzAZ:Qoa1taC03KcWb1X9fnLVAe

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2348	3335.tmp

Executes dropped EXE 1 IoCs

pid	Process
2348	3335.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 2348	3788	ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe	89
PID 3788 wrote to memory of 2348	3788	ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe	89
PID 3788 wrote to memory of 2348	3788	ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\3335.tmp
  "C:\Users\Admin\AppData\Local\Temp\3335.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ff8aebd573993b97453855e132d9756f_JaffaCakes118.exe 8EC9D393C528B986B002819BFCAA195BA45C87BCF5D70501C51F330474FB2577345E93A6A4FAEFD62F2EEEE2E4B705E5DE2EB42C060BCE9F4B481EAFCBD5C40D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2348

C:\Users\Admin\AppData\Local\Temp\3335.tmp

Filesize
1.9MB

MD5
c6f3f744ff6cdabf5eaf880d9e7737d7

SHA1
a158c1aa1f5fd9c8c55b5dddce6a53551461ab5d

SHA256
72d5411e6fbb11cd253d90454c4b99485e08f6702ea8517b09f45100f51dee2e

SHA512
9a489465637066807efd67e2cb84be6cb11288798d8972ce885cb9752b0c0cb6a7b5719349fea75b1755a7e497c3c7ab27c575cc8d5a714a3645ff05cc0a63d4

Download Submit
memory/2348-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3788-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download