f7657176304f05b26f7646f6a4af9178e39dce032a8e8d32a554e7b5cd807641

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:56

Target
2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe
Size 108KB
Sample240510-gnaarsef5w
SHA256 f7657176304f05b26f7646f6a4af9178e39dce032a8e8d32a554e7b5cd807641
MD5 2dad3c42dafb13ecaba62073881b7100
SHA1 6c68fae5556514526fb7650199855c362c8e47a1
SHA512 cb02e8e3b82cd6fee976e52157d0e550120ae734343a2641c78cb78cf442359bd58d653f498e633891377dadcf39ccdf74474e273879ec15abf92476c2864e9c
SSDEEP 3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnhJvHI+zIcErrp5:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXTI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4612	3028	2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe	82
PID 3028 wrote to memory of 4612	3028	2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe	82
PID 3028 wrote to memory of 4612	3028	2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dad3c42dafb13ecaba62073881b7100_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:4612