d3b9138b620139601041e436e3879fb7b08b5f812f91a04ac03ca50636e679fb

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 00:22

Target

1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe
Size

206KB
MD5

1ed278964455c8ac3c202ed075b51ed3
SHA1

bb69cbff24e1dda9108880a51df05ad552f3b17c
SHA256

d3b9138b620139601041e436e3879fb7b08b5f812f91a04ac03ca50636e679fb
SHA512

47631227f453bbaab29ac95e8e868224abebfc9a794390cd770f29de6e7464676dc3e9417fac6c9cdea887b745ec5d052edefe04c76c6b63274d037b543cc617
SSDEEP

3072:Igm+rjPBVfV8XOBoFAdj58j3HPO303voR7yQpEK6fXvke3y09iZe5S:Igm4NV21ydUXPO3W6yK6fsmqe

Score

6^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4860	1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe
4860	1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2124	4860	1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe	83
PID 4860 wrote to memory of 2124	4860	1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe	83
PID 4860 wrote to memory of 2124	4860	1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:2124

memory/2124-0-0x0000000000AE0000-0x0000000000AF2000-memory.dmp

Filesize
72KB

Download
memory/2124-5-0x0000000000940000-0x0000000000977000-memory.dmp

Filesize
220KB

Download
memory/2124-2-0x0000000000AE0000-0x0000000000AF2000-memory.dmp

Filesize
72KB

Download
memory/2124-4-0x0000000000AE0000-0x0000000000AF2000-memory.dmp

Filesize
72KB

Download
memory/2124-6-0x0000000000AC0000-0x0000000000AC2000-memory.dmp

Filesize
8KB

Download
memory/2124-7-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2124-19-0x0000000000940000-0x0000000000977000-memory.dmp

Filesize
220KB

Download