2440d0913a69419211c57ce2051419ed9979b3414b21ef16ac9f0b22fafdf88e

Analysis

max time kernel
67s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 22:21

Target

0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe
Size

2.0MB
MD5

0632ff3aea9bd337396351690ac1d861
SHA1

fdf7405296418b002b64d8ba85ecec0bc7d9edc1
SHA256

2440d0913a69419211c57ce2051419ed9979b3414b21ef16ac9f0b22fafdf88e
SHA512

61704f88f2c09224a62c8a380538edf9e1a2f88bfe9b8954ae2cc20eded56c1aa07a51a437d872ba437a2bcda11607124cc7a5490cb73af03e9213376f31ccbb
SSDEEP

49152:h9bwaU13IMC6zpnr4lvb91zRUF1RSoeofXjx24knf94+/b/:faoPlv51NK0oe+Xjxmi+/b/

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2268	0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2268	1696	0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe	84
PID 1696 wrote to memory of 2268	1696	0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe	84
PID 1696 wrote to memory of 2268	1696	0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\is-JLOAS.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JLOAS.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp" /SL5="$8011E,1854971,52736,C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:2268

C:\Users\Admin\AppData\Local\Temp\is-JLOAS.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp

Filesize
689KB

MD5
39aac789079975156ed2ef01b2cf3731

SHA1
430d1e284a263a6ba4cd55dffcdac6e6021b57db

SHA256
4f6f834ca1d1e3f198c87c76f75b882c8f238cb30a8bf1760e255ad27f5fb8d1

SHA512
3f1e772539ad79ae7380afd8e336b7a991b033878fac06ad3879b6d09d9a3631c4d8348ca0c2481d3a42fc20eed02bd431631ab4b789e3862bf96e574d30e328

Download Submit
memory/1696-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1696-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1696-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2268-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2268-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download