0e85fd74aed1ff2c76f7a11bd659b5ed12b9543a44790fa90109685f67fc579d

Analysis

max time kernel
141s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:44

Target

6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe
Size

4.1MB
MD5

6909707e441835e2e13df11d0d479a59
SHA1

c9167c944d201f12e72a8ce41eda47afcaa83cc7
SHA256

0e85fd74aed1ff2c76f7a11bd659b5ed12b9543a44790fa90109685f67fc579d
SHA512

c48d3fe1853c4760f6b9babf2c61f4ab953e42a49f1e6a9dfb93a18862196a7dce561a9fa6baf71b4d04008db444e95c8e11191230d74fc38c1f43dca60bde9e
SSDEEP

98304:BXWcEr6Pvjhn+8YZMheFN3DCnl29Q+M0ggF5KdGun+RZRqp:BXjfjx+9ZMhSmlMQ+N1aQucqp

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp

pid process

1456 6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp

pid	process
1456	6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe

description	pid	process	target process
PID 4172 wrote to memory of 1456	4172	6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe	6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp
PID 4172 wrote to memory of 1456	4172	6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe	6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp
PID 4172 wrote to memory of 1456	4172	6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe	6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\Users\Admin\AppData\Local\Temp\is-JP6K7.tmp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JP6K7.tmp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp" /SL5="$401EE,3806852,140800,C:\Users\Admin\AppData\Local\Temp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\AppData\Local\Temp\is-JP6K7.tmp\6909707e441835e2e13df11d0d479a59_JaffaCakes118.tmp
Filesize
1.1MB

MD5
b277e6ac242fcbc37f4d03e1528949c1

SHA1
2602407044a6bad216d3856eaf8fb990e0f1094f

SHA256
9461ae8a13a57c0d8490916dc1e1bb20cb0c171b9852d0846a03c4c4d212f204

SHA512
80d8b934ff63e4a7df3dabb9e6435c2d5ea542624b238be8a27b53c63be8dc244d46d4d9db1950b6d67d91dde12f3d819e7e4453536595d6385c65d2c6bbf5f7

Download Submit
memory/1456-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1456-13-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4172-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4172-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/4172-12-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download