d64d20b79367deb9fd1b63532755cf7d728b39a0e123d51a9f1e638fc26bb415

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 07:39

Target

5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe
Size

5.5MB
MD5

5de80180461aeb5ac61b08f756c83f33
SHA1

f4530137692d362e59b9f2405f536be7711ff132
SHA256

d64d20b79367deb9fd1b63532755cf7d728b39a0e123d51a9f1e638fc26bb415
SHA512

53bf687422e181e606e0e52b4618da87c9d634026f83cef948c928603ddd87a6e30623e209181a89a9328c5fe822fb40c47ce8e4af9688e0293b5cd2be77dad8
SSDEEP

98304:X5Qz/4ktcy8VbiXqx/uQIrKtXwFOT8XuQHyuj0roJkbnrlqj7hoF2vCwoKFs0/KG:K/9XMbaq/uDraylXnbj0sJkLrlw7h+Sv

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2276	5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.tmp

Loads dropped DLL 1 IoCs

pid	Process
2276	5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2276	412	5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe	83
PID 412 wrote to memory of 2276	412	5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe	83
PID 412 wrote to memory of 2276	412	5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Local\Temp\is-OU64U.tmp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OU64U.tmp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.tmp" /SL5="$40214,5553518,57856,C:\Users\Admin\AppData\Local\Temp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2276

C:\Users\Admin\AppData\Local\Temp\is-5L2G5.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OU64U.tmp\5de80180461aeb5ac61b08f756c83f33_JaffaCakes118.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
memory/412-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/412-3-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/412-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2276-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2276-12-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download