60b601849145b2a6a4012f4a7adfc37ea4c4a9695989cd37536b4e81c026636b

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 18:17

Target

76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe
Size

21.1MB
MD5

76621296b043d89ace9789dd532f80f6
SHA1

b4daea724e64d2f1f4b489e5f2dc8f8ec4e57f84
SHA256

60b601849145b2a6a4012f4a7adfc37ea4c4a9695989cd37536b4e81c026636b
SHA512

e9b925dbeaec21007487c725847e74887167b9557c354d003cb4890b654f27e018707a1085cdc4d9560e5fe765b73bf556e4b9433c4a625cfbd14b0563204739
SSDEEP

393216:NdItIlcYcdb5QLeKsbnRaf3+kKUdzGE8GleTlASr/hkgts6jRg1R:Ly8iR5QqKsQ+kKkV8GoTlAW/hhsI2

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3128	76621296b043d89ace9789dd532f80f6_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 3128	968	76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe	82
PID 968 wrote to memory of 3128	968	76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe	82
PID 968 wrote to memory of 3128	968	76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\is-NHKNT.tmp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NHKNT.tmp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.tmp" /SL5="$601DC,21597092,552960,C:\Users\Admin\AppData\Local\Temp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3128

C:\Users\Admin\AppData\Local\Temp\is-NHKNT.tmp\76621296b043d89ace9789dd532f80f6_JaffaCakes118.tmp

Filesize
1.5MB

MD5
6848f22caec5f39ecd3d0f9471e81743

SHA1
320a51fcb24e7ea836b322d0b21a65e3382bae18

SHA256
45e99c3ff00858b610a96dd2263c1dbf5adddf90b0f115ad5b0defa91cb4fe7c

SHA512
9749da16a1e82fd1ace3358445a55028e695ee9921e9f0c40279af06bd440d15497e3cb0a64d1afc9cc97e62fd23f23b6f73ac3fa2730a33cf47855480d5ee42

Download Submit
memory/968-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/968-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/968-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3128-7-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/3128-17-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download