29d04b65d7fa77a28a4906a2f0d8c1cee2ab3784cb6cdd4a31d1c4bb8abd09c6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:46

Target

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Size

283KB
MD5

ffbb51b968abc45197bef0cd465fe72f
SHA1

5d44ac78f2351c3d837ed52bc1b4a75473960ce1
SHA256

29d04b65d7fa77a28a4906a2f0d8c1cee2ab3784cb6cdd4a31d1c4bb8abd09c6
SHA512

dc5532305a2b3e0420a2021656e00b9ca03a31c28503f07e946a2de1bc44256d4649a447dc5ac24d109946f5acf3aa3409e6f564f7dcde1e540e7decc793ee71
SSDEEP

6144:B2aZdLuq/i+iXRx9CjEZOyatGJrP8tZnLVx1UOAsO:JZXMRLCjEZOyNJbWZhx10

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3024 wrote to memory of 1544	3024	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	85
PID 3024 wrote to memory of 1544	3024	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	85
PID 3024 wrote to memory of 1544	3024	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe"
  2⤵
  PID:1544

memory/3024-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download