e92a7b91f64aa977337fee620f41a87731e99af5c6743f6ea6172f83b96d3024

Analysis

max time kernel
141s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 23:10

Target

a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe
Size

3.4MB
MD5

a2dd4247197fd40312f99921bdd3cb33
SHA1

ea9c3670b8da4cf2780cb92932be3d3a863426af
SHA256

e92a7b91f64aa977337fee620f41a87731e99af5c6743f6ea6172f83b96d3024
SHA512

956223b9ce559fc31e4fd20f3aeece2e16ac1d760cf7cdb7887186fd2c3d4e0f558100874d2175e056f06d449be2dd14243d43afc4c4f414f7c3f3097369dbff
SSDEEP

98304:HigfdkDnqwMpYL5opu9A3I59cVIq0Lf0JC:Hi4RwMpYL6pu9iwqlEsQ

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3240	a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3240	4496	a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe	81
PID 4496 wrote to memory of 3240	4496	a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe	81
PID 4496 wrote to memory of 3240	4496	a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\is-VBF5T.tmp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VBF5T.tmp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.tmp" /SL5="$C006A,3163193,119296,C:\Users\Admin\AppData\Local\Temp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3240

C:\Users\Admin\AppData\Local\Temp\is-VBF5T.tmp\a2dd4247197fd40312f99921bdd3cb33_JaffaCakes118.tmp

Filesize
1.1MB

MD5
6a96bef4679e16a54b4090e74664dcca

SHA1
c8631c1624b98f6709b1ac37ce3956faed29bc30

SHA256
cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783

SHA512
924ab1e5c6ea72342eab6e78899a56c415e90020c46d3d8a81ae4da9276db7ea1df9684965a81fb95a6f2f9cf103b31413d67770eb15725ad04198c5d00037d0

Download Submit
memory/3240-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3240-12-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4496-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4496-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4496-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download