a7462b410c1d18f0426e5d656056be92b11a672c90494a80100d2ef53c50a502

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 17:20

Target

72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe
Size

224KB
MD5

72b100a1060fc54bf3bc476862b771cf
SHA1

3f2c552aa8383078a62c3242308cfef5fab382f9
SHA256

a7462b410c1d18f0426e5d656056be92b11a672c90494a80100d2ef53c50a502
SHA512

2a24820ba0c77b3f819a9ead0e3489a162c12764713b268ad7fc1a253ffbf9c5e2c477896686d518b485422b27b4adff2b3fbf0001a0d57d9bee7e870e07ee75
SSDEEP

3072:wM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AVtaO4V:wgzQ+D7ljXma/WxSTi7rT8xHYZ4V

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5020	serialtaupe.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3164	72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 5020	3164	72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 5020	3164	72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 5020	3164	72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72b100a1060fc54bf3bc476862b771cf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\serialtaupe.exe
  "C:\Users\Admin\AppData\Local\Temp\serialtaupe.exe"
  2⤵
  - Executes dropped EXE
  PID:5020

C:\Users\Admin\AppData\Local\Temp\serialtaupe.exe

Filesize
224KB

MD5
72b100a1060fc54bf3bc476862b771cf

SHA1
3f2c552aa8383078a62c3242308cfef5fab382f9

SHA256
a7462b410c1d18f0426e5d656056be92b11a672c90494a80100d2ef53c50a502

SHA512
2a24820ba0c77b3f819a9ead0e3489a162c12764713b268ad7fc1a253ffbf9c5e2c477896686d518b485422b27b4adff2b3fbf0001a0d57d9bee7e870e07ee75

Download Submit
memory/3164-2-0x00000000005C0000-0x000000000060A000-memory.dmp

Filesize
296KB

Download