d634604dd976e7de4b8cffcfadd86ae6609efe8a0f696a01b5e8acaa7f13d993

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 13:17

Target

0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe
Size

511KB
MD5

0e9ba45cb73a4c581b83f5a3526f84b4
SHA1

313b58e9221b1d456a68e98b93006fed936b6379
SHA256

d634604dd976e7de4b8cffcfadd86ae6609efe8a0f696a01b5e8acaa7f13d993
SHA512

68d2590e4020b22ded78c463668292e51740dd2bc18728058c61f0f5ed8a38fe28d8668d351df7b9354350ec32bcfff5d0a06f171ff66ba4c8770d87d82f7595
SSDEEP

6144:4aho6wVta6Pwo0UrrClz1sNbPqLBmLPQgnTmhCmOlV1XKV3CzIcN5fcFkJrxeIWD:JfwsW3h0S44RnTmtQUYz44eIW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 1972	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	85
PID 64 wrote to memory of 1972	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	85
PID 64 wrote to memory of 1972	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	85
PID 64 wrote to memory of 2404	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	86
PID 64 wrote to memory of 2404	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	86
PID 64 wrote to memory of 2404	64	0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe
  start
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\0e9ba45cb73a4c581b83f5a3526f84b4_JaffaCakes118.exe
  watch
  2⤵
  PID:2404

memory/64-0-0x0000000000468000-0x000000000046B000-memory.dmp

Filesize
12KB

Download
memory/64-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/64-5-0x0000000000468000-0x000000000046B000-memory.dmp

Filesize
12KB

Download
memory/64-2-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1972-3-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1972-7-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1972-9-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2404-6-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2404-8-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2404-11-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download