8218ba3b223ee86999d28cbae40e363c177f963c4228b8b2da241734596bf2da

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 22:30

Target

315ab600160990866a84e3d22b007b30_JaffaCakes118.exe
Size

2.5MB
MD5

315ab600160990866a84e3d22b007b30
SHA1

8c6893894317cbc546f7c4119529ba2c14551c18
SHA256

8218ba3b223ee86999d28cbae40e363c177f963c4228b8b2da241734596bf2da
SHA512

48e388a64ca9e6270ceeca2e0a3b7615da8ba4642a4c9bdb4827e6b47ee530dd57197c443222aec65812c63198617814e1ef0bbb68b33ff72cba243363ba1cb7
SSDEEP

49152:o+V4UJxCNP/3dhk6FWl/ncncHHD3lZ6b+aWaSZDSf6cFQk7xzJL:7VJxCNP/39FsdzlZvDSf53z

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4192	MpMiniSigStub.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4192	1876	315ab600160990866a84e3d22b007b30_JaffaCakes118.exe	80
PID 1876 wrote to memory of 4192	1876	315ab600160990866a84e3d22b007b30_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\315ab600160990866a84e3d22b007b30_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\315ab600160990866a84e3d22b007b30_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- \??\c:\716d336ef32b8b90697a\MpMiniSigStub.exe
  c:\716d336ef32b8b90697a\MpMiniSigStub.exe
  2⤵
  - Executes dropped EXE
  PID:4192

C:\716d336ef32b8b90697a\MpMiniSigStub.exe

Filesize
31KB

MD5
b3baa44fb1f8f39ef2c4f9c05aaa1dea

SHA1
9236debd3f289ced5e13b14b813a311e475eb93d

SHA256
e200fbe1d5be06faa6ad5c917d4d745e419bc68a9acea7f544e213bfc5f25660

SHA512
201a09388fabdc2fd193773d910766ced193c4c09918a6d2aafb11b0aab21473b36ce2bba940aa1e9378e14ba0ba5d2ceed29d7d7c50cbb3d80a00e06fed3484

Download Submit