0f14875c6e087ed02e1c10d13895342a5b83290e30882e7fe6d235edc2848319

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:28

Target

26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe
Size

224KB
MD5

26d3b6b53fa8c71b12c1f9cd1be03002
SHA1

e795e35cf6b2106a85dc3ac3761661d12862d158
SHA256

0f14875c6e087ed02e1c10d13895342a5b83290e30882e7fe6d235edc2848319
SHA512

a54b05bc27674ee0e216f2904cf95ce181d7d51bc16b33a6f79d94f06d0b85711a50d4ef2b0a9800178c49bc865fec356689f6f29c06f3a3084d737259bc5063
SSDEEP

3072:EM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AViaO4VW:EgzQ+D7ljXma/WxSTi7rT8xHY64VW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3132	handlercaml.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3564	26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3132	3564	26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe	78
PID 3564 wrote to memory of 3132	3564	26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe	78
PID 3564 wrote to memory of 3132	3564	26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe	78

C:\Users\Admin\AppData\Local\Temp\26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26d3b6b53fa8c71b12c1f9cd1be03002_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\handlercaml.exe
  "C:\Users\Admin\AppData\Local\Temp\handlercaml.exe"
  2⤵
  - Executes dropped EXE
  PID:3132

C:\Users\Admin\AppData\Local\Temp\handlercaml.exe

Filesize
224KB

MD5
26d3b6b53fa8c71b12c1f9cd1be03002

SHA1
e795e35cf6b2106a85dc3ac3761661d12862d158

SHA256
0f14875c6e087ed02e1c10d13895342a5b83290e30882e7fe6d235edc2848319

SHA512
a54b05bc27674ee0e216f2904cf95ce181d7d51bc16b33a6f79d94f06d0b85711a50d4ef2b0a9800178c49bc865fec356689f6f29c06f3a3084d737259bc5063

Download Submit
memory/3564-3-0x0000000000150000-0x000000000019A000-memory.dmp

Filesize
296KB

Download