aa6a1252137858969d62a2ab8f663cae3254725f687f42a4dd8fb9a2de5bc888

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:24

Target

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe
Size

1.1MB
MD5

65d74edf5d5f32f01f74d9638bb3a529
SHA1

4fc01b1b0ca33a1ceabb345f7d709855d372251b
SHA256

aa6a1252137858969d62a2ab8f663cae3254725f687f42a4dd8fb9a2de5bc888
SHA512

1f6c0bd921fa7370a0b2f0d15c015cda3050d10ffe536288ee6e0effd830400a79ec539bfb42509f26c9857571d52e8c9a97f791300832ebbd828938d77a145e
SSDEEP

24576:TQiZ5X0K8+81OfIIhyEqWN50NxIYxxsvLcLdi/XKxSPpfsQqyGlR53:T9zs8ITg50/XeQLdi/XKxSPpfsJyGlRd

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid process

1084 65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid	process
1084	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe

description	pid	process	target process
PID 3144 wrote to memory of 1084	3144	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 3144 wrote to memory of 1084	3144	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 3144 wrote to memory of 1084	3144	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3144

C:\Users\Admin\AppData\Local\Temp\is-LRI3Q.tmp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LRI3Q.tmp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp" /SL5="$B0068,933080,56832,C:\Users\Admin\AppData\Local\Temp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
PID:1084

C:\Users\Admin\AppData\Local\Temp\is-LRI3Q.tmp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

Filesize
699KB

MD5
42bc0a6e911179bb0cbf0d2445c8db8b

SHA1
9e865d759d14cfaf00578779baed491be311f946

SHA256
e56f4e8207b00ae6decf5aa890815c4a2acde5abb2fa336e2a2a5d739fa55a3a

SHA512
b837dcd51d28856fbac7dda820f192610f9c42753e4c3b93cbe0b47f3bbaa3fa0b985ef9e164715516c47cde3dbc7c3534b1e99924f7aa7d39111ea55cf7259d

Download Submit
memory/1084-11-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1084-13-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3144-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3144-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3144-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download