40cd8a4a5f949a54a7eadafc631c2a51d4281c45ba35d4011c1eacc6199b2b4a

Analysis

max time kernel
141s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Target

65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe
Size

12.6MB
MD5

65d552ce080405c423fcebb259f98dd5
SHA1

f8e88ed61d883bfef1007935e213c80684596eaa
SHA256

40cd8a4a5f949a54a7eadafc631c2a51d4281c45ba35d4011c1eacc6199b2b4a
SHA512

a1e30b760d6d23fb47f32d50b8909775154afc7f61a5dee056d8319dba7e5469e9c9115f0c684775a40bfb7d3b04cc0115dbeef4a7cd13b102a7dc64b41b8f20
SSDEEP

393216:7cFjTRPsDBzLKjK0rPv2eeEdhjZScG5amy:wFjJsl3K+0rPeeemGq

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp

pid process

4852 65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp

pid	process
4852	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe

description	pid	process	target process
PID 3864 wrote to memory of 4852	3864	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp
PID 3864 wrote to memory of 4852	3864	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp
PID 3864 wrote to memory of 4852	3864	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe	65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Users\Admin\AppData\Local\Temp\is-34L9A.tmp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-34L9A.tmp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp" /SL5="$B0058,12669811,119296,C:\Users\Admin\AppData\Local\Temp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
PID:4852

C:\Users\Admin\AppData\Local\Temp\is-34L9A.tmp\65d552ce080405c423fcebb259f98dd5_JaffaCakes118.tmp

Filesize
1.1MB

MD5
4de6f44810bad050ac81f45549d58f34

SHA1
e001b982a0a978deed96789f943bf295dd2ba1d8

SHA256
cf8a77f4cbd38f6ab44fcff738f81ec8dfdaa7ef5a64d62fdd84c6fe897adff5

SHA512
550e468c3d6660ce2030fca16549eace9153610e19621cba83fea691f8d0091edb596a869168cf4b7f80fa55a808ca1703e4e2beffb3ade5af3fb67b6ead6673

Download Submit
memory/3864-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3864-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/3864-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4852-7-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4852-13-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download