ddd4cf45761e61195972efc03383ef417491294bc351d65e4cb7318239ba9457

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:34

Target

3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe
Size

552KB
MD5

3d665def1ab253bdbfc9d80750cec9e2
SHA1

b12ab9f7a242ffa666938028a3f20251c0fe4053
SHA256

ddd4cf45761e61195972efc03383ef417491294bc351d65e4cb7318239ba9457
SHA512

cfaa68f8a30d68f3ff9d5f697f888c9c74d9320f9bc3bfd8dc69ee2da1d53a54561e305546ba46acfa8a9f8db6e1f95b22be49350edddbfcdd61818db2ea2152
SSDEEP

12288:Bu7JMIKUoJ1L5o1zft7wW65H+WFudD6Hj0fz:gMBUoDLSz17wW6jj0f

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4572	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	83
PID 4564 wrote to memory of 4572	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	83
PID 4564 wrote to memory of 4572	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	83
PID 4564 wrote to memory of 1652	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	84
PID 4564 wrote to memory of 1652	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	84
PID 4564 wrote to memory of 1652	4564	3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe
  start
  2⤵
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\3d665def1ab253bdbfc9d80750cec9e2_JaffaCakes118.exe
  watch
  2⤵
  PID:1652

memory/1652-6-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1652-8-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1652-11-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4564-0-0x0000000000472000-0x0000000000475000-memory.dmp

Filesize
12KB

Download
memory/4564-4-0x0000000000472000-0x0000000000475000-memory.dmp

Filesize
12KB

Download
memory/4564-2-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4564-1-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4572-5-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4572-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4572-9-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download