fad25f97c0fb28f758278a492b45e65d17d38a71b6f2daf3557dd50178795dfb

Analysis

max time kernel
137s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 11:27

Target

45f4a39afe7e5213653c3e78a50b0ea8_JaffaCakes118.exe
Size

2.4MB
MD5

45f4a39afe7e5213653c3e78a50b0ea8
SHA1

ff9f0355f666c818026353beb26819d4d9d652aa
SHA256

fad25f97c0fb28f758278a492b45e65d17d38a71b6f2daf3557dd50178795dfb
SHA512

f26e918ba2b8f9409ac541c2adce00743e4701d6cf71681bde505596b34d02439309bd13b958e3fa8c5920b3b4688b59a2d74039ba2c917e7a2fd4b1206394ff
SSDEEP

49152:q+lkWEH8ooE+fK1q8Lq4QG3qmkIth54sqNjIb5d7MJ8nNL8C6S7lasv:hkW6Z7rI4QG3pq9Ib5lnNL8CxF

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1036	MpMiniSigStub.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1036	984	45f4a39afe7e5213653c3e78a50b0ea8_JaffaCakes118.exe	83
PID 984 wrote to memory of 1036	984	45f4a39afe7e5213653c3e78a50b0ea8_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\45f4a39afe7e5213653c3e78a50b0ea8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45f4a39afe7e5213653c3e78a50b0ea8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- \??\c:\52b9dd12fb499e1b9759b1\MpMiniSigStub.exe
  c:\52b9dd12fb499e1b9759b1\MpMiniSigStub.exe
  2⤵
  - Executes dropped EXE
  PID:1036

C:\52b9dd12fb499e1b9759b1\MpMiniSigStub.exe

Filesize
31KB

MD5
b3baa44fb1f8f39ef2c4f9c05aaa1dea

SHA1
9236debd3f289ced5e13b14b813a311e475eb93d

SHA256
e200fbe1d5be06faa6ad5c917d4d745e419bc68a9acea7f544e213bfc5f25660

SHA512
201a09388fabdc2fd193773d910766ced193c4c09918a6d2aafb11b0aab21473b36ce2bba940aa1e9378e14ba0ba5d2ceed29d7d7c50cbb3d80a00e06fed3484

Download Submit