1700d693f0aa99d646586d09d0a0079b489198ddc77c078137b4b63189287420

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:59

Target

1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe
Size

2.8MB
MD5

1f101af194c4445b253930ad16ac8f60
SHA1

f9f49cc0b91e4026c109ed12a118e945490edf24
SHA256

1700d693f0aa99d646586d09d0a0079b489198ddc77c078137b4b63189287420
SHA512

520722ed560db70d1bb14a9b7e798be7f6ba522bcb37eab8d649731169a9bf4672b4e7bc3d62bb7197d32aefd2db7b7507216aa6c398ec48b700afedf31a00d4
SSDEEP

49152:La7j9uH4rwMiyOdm/UPrsolf6HKB2h1Z5azj+Y4t/qvdOvs50oGKWNMvoJT:GtuvMxL0f6qBorazGt/wTOKzvod

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5112	1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5112	5064	1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe	84
PID 5064 wrote to memory of 5112	5064	1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe	84
PID 5064 wrote to memory of 5112	5064	1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\is-IB358.tmp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IB358.tmp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp" /SL5="$90042,2718172,62976,C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:5112

C:\Users\Admin\AppData\Local\Temp\is-IB358.tmp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp

Filesize
696KB

MD5
4551b18a00f9886738a034da202b528d

SHA1
c00a029f89489770ec292c34da1bee969b091112

SHA256
481f8369ac57c86a779cf42e589b1d4af041223fe01bb419549a843f2efa07c2

SHA512
e8e5d17d12f84f7609b3f3244d873c83dbdd52b6d064df8052dc3e8a3f0394b67dec5de236a047acede2e977787b5e739c2f24463c2db1455625690997d5e35c

Download Submit
memory/5064-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5064-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/5064-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5112-7-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/5112-14-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download